As someone who is currently having to take away people’s local admin rights along with a ton of other privileges: it’s not like we do this for fun, we have compliance goals to reach that were agreed to by higher ups outside of the IT department in exchange for public funding (we’re a public institution).
Cool, here is a VM without domain join and no access to internal resources. Feel free to use your admin permissions on there.
Seriously though: developers need admin access during prototyping unless you are a giant enterprise that already has CI\CD, dependency management, staging environment etc all set up and properly configured. For everything else, devs should have their contained sandboxes with admin permissions
*and all those environments come with admin teams (devops, sysops, call them whatever) actually good at what they do. Because I have a long list of things to vent about exactly because:
- you’re a dev, so fight us for access and permissions (edit: that I already have ssh access to prod servers and thus could wreak havok any moment if I wished to is completely ignored)
- here’s a botched something you asked. It is not configured/improperly configured - well, who da fuq cares. Let’s have another kanban card for fixing this
Y’all joke, but when that ‘task’ is run through process monitor, we see it’s trying to overwrite a DLL in system32, create a directory at root of %systemdrive% or cache some data in the Program Files application itself, instead of utilizing ProgramData or Appdata properly.
When applications fail these simple practices and demand local admin, they shouldn’t touch your network.
<3
I’ve worked for two organisations that distributed licences for users. Being able to prove, under scrutinisation, that your general requests do not need to be questioned for that level. Anything above your level of liberty in the data governance would be checked—though 99% of the time you already know this and explain in full detail on the request to help.
It worked perfectly and I don’t know why it’s still not the norm.
In a ‘wet cement’ org structure, often the specialists in an area know far more about what’s going on than the juniors gatekeeping. If you aren’t buddies with the person on top, you join the queue and a 5 min job becomes 6 months and several meetings; if you don’t already botch a dodgy workaround before then.
Edit: I’m in year 3 of getting the Oracle SQL add-on allowed to direct query, read only, in Excel. My current workaround is to use the IDE to export to CSV, store on SP, then PQ that… And, yeah, I have write access in the IDE even though I keep telling them that’s bad… Apparently, that solution is more secure. I’ve spoken to the CIO about the concerns and how it breaks the fundamentals of our data governance framework. The new infrastructure architecture gets it, but has to spin the better way of doing things as a “trial” which has taken 6 months to approve and counting…
Reading your comment at night does feel like a horror story
