Wednesday, September 27, 2017

Bring the Shame

This blog is dedicated to shaming any software vendor, consultant, or pundit who suggests you grant Domain Admin rights to a service or application to "make it work". Almost no one and nothing needs domain admin rights. Active Directory lets you delegate out rights in a very granular way.

Nearly as bad and needless is hard coding your installer to require the user be a domain admin. Unless you are installing a new domain controller, you should never need to install anything as domain admin. One can always delegate out the rights needed by the tool or app.

Granting an application domain admin rights is like giving out the master key to your 120 acre resort to the pool lifeguard. The key grants access to all the guest rooms, the boiler room, the kitchen, etc., when the pool lifeguard just needs access to the guard shack and the pool mechanical room.

No comments:

Post a Comment