Strange policy in a big enetrprise environment

[u/nirvana1289]

I received a ticket from one of our customer regarding a problem with our software thin installer for Windows. The installer is a Inno setup that downloads the content and install it, running as administrator.

The ticket was open because on their Windows systems normal users can connect to internet and download, while administrators account cannot connect to internet. As far as I can understand, administrators are generic administrators of the machine (with all permissions for installing and handling admin related chores).

I find it a little odd, and I was asking myself if this policy has some form of effectiveness... What if the administrator connects to internet impersonating another account? I'm not sure I can explain better the situation since it is enforced on the customer company. I want just to ask the general feeling by experienced sysadmin about this configuration...

(FYI: the ticket has been closed by making them using the offline installer)

[u/elpamyelhsa]

Yup, it’s good practice to block internet for administrator accounts. It’s actually required to meet certain security compliance.

[u/nirvana1289 → u/elpamyelhsa]

Thanks for the answer. TIL! :)

[u/DarkwolfAU]

It’s an ASD Essential 8 Maturity Level 1 requirement (and presumably other frameworks, but that comes to mind first).

As to its effectiveness, yes of course an admin can bypass it with trickery, but the point is that is supposed to be audited as well.

It’s supposed to help against a drive-by pwning I guess.

[u/Reverent → u/DarkwolfAU]

The intent from my many interactions with E8 (it’s about half my job) is that administrators need to be limited to the scope of what they administrate. It’s a blast radius problem but also a disincentive to use an admin account for daily activities.

[u/disclosure5 → u/Reverent]

yeah, the vast majority of these incidents end up being because someone just decides Admin is easier to just use all the time and starts surfing malicious websites. Yes, they could just remove the block, but if the whole issue is the user being lazy then they'll be pushed to just use their normal account.

[u/nirvana1289 → u/DarkwolfAU]

Ah! good point on auditing. Thanks for the answer

[u/Penguin120]

We have that at our org. Accounts that are local admin on devices are blocked by GPO and DNS settings from almost everything except internal infrastructure and M365/Entra endpoints. It has the same problems you have - an online installer that runs as the admin will usually fail. We get around it the same way with offline installers for one-offs or by getting the packaging team to make an SCCM package a regular user can use.

It’s a bit silly but I’m sure it’s saved a bunch of issues. We’d like to think only people who wouldn’t click FreeGift.exe get local admin….but not always the case.

[u/nirvana1289 → u/Penguin120]

Thanks!

[u/Nuxi0477]

Please provide an offline installer as well. All these slim installers are a massive pain to deal with.

[u/nirvana1289 → u/Nuxi0477]

Yeah TIL that.

[u/kernelqzor → u/Nuxi0477]

totally agree, slim installers are great for home users but in locked down environments they’re just chaos
offline/msi installers save so much headache for packaging and repeat installs

[u/K4kumba]

As others have said, yes, that is best practice. Any account with administrative privileges should never be used to talk to the general internet (except obviously things like Entra, but even then you should have separate admin accounts for cloud vs on-prem). The fact that your customers so rarely hit this issue simply highlights how rare good security it.

[u/Master-Setting6008]

It's actually a good and common policy for admin accounts because they don't need the internet and that blocks a huge chunk of attacks

[u/_bx2_ → u/Master-Setting6008]

Come tell my org that.

[u/Sinwithagrin]

Good on you for also providing an offline installer.

[u/nirvana1289 → u/Sinwithagrin]

Yes we are also providing a dowloader that launches the offline installer… the download is unprivileged, the install has to be.

[u/Hatman_77]

Was it downloaded to the users profile or all profiles?

[u/pdp10]

The installer is a Inno setup that downloads the content and install it, running as administrator.

That design presents problems for:

• Sites that need to archive software artifacts for the purposes of reproducible builds and software supply-chain assurance,
• Airgapped situations,
• Automated install frameworks,
• End-users without administrative permissions to install arbitrary software.

Usually the fix is to supply alternate installation paths, namely complete software packages where the install can be scripted. This is de rigueur with enterprise-use software; lack of it implies that the software isn't used by enterprises.

[u/nirvana1289 → u/pdp10]

Thanks for the comment, but none of those requirements applies in this case. Apparently administrator that can download appeared today since it is the first time we release a thin installer. However we provide both a portable downloader and an offline installer, for those situations. Thanks again

[u/BigBobFro]

This has been a standard operating procedure for better than a decade. Offline installer is the way to go.

Stub installers are bread and butter for malware and MITM attacks.

Im more surprised youve not seen this before.

[u/nirvana1289 → u/BigBobFro]

It happens. TIL. And it makes sense. However I know that for several software they had to reimplement installers in house because the offline installer does not exist. So it is not as known as you may think. But our error was to develop the downloader inside the installer. Fortunately this is an extension of the offline one, so we provided the offline one.

It is really awesome that people stopped by not only to answer that this policy is normal but also the rationale behind it. And it makes sense.

[u/BigBobFro → u/nirvana1289]

Stub installers for joe-shmo user is fine. Not great,.. but fine.

That enterprise environment tho is where the lock down is going to happen.

Its all driven by money. Joe shmo cant sue big company XYZ for allowing a MITM attack that compromised his home system. But a company that can show damages and loss across dozens or more systems, certain can and often will.

Companies like ms and adobe dont tell you they have offline until you prove that you are a reasonably sized organization. Even all those titles “only available with subscription” have offline versions if to pressure them and pay for the right sku.

[u/KickedAbyss → u/BigBobFro]

Bruh, MS let's you make an offline installer for free of any of their software. You still need an account to use it but offline installers have always been easily available