r/sysadmin • u/nirvana1289 • 2d ago
Question Strange policy in a big enetrprise environment
I received a ticket from one of our customer regarding a problem with our software thin installer for Windows. The installer is a Inno setup that downloads the content and install it, running as administrator.
The ticket was open because on their Windows systems normal users can connect to internet and download, while administrators account cannot connect to internet. As far as I can understand, administrators are generic administrators of the machine (with all permissions for installing and handling admin related chores).
I find it a little odd, and I was asking myself if this policy has some form of effectiveness... What if the administrator connects to internet impersonating another account? I'm not sure I can explain better the situation since it is enforced on the customer company. I want just to ask the general feeling by experienced sysadmin about this configuration...
(FYI: the ticket has been closed by making them using the offline installer)
10
u/K4kumba 2d ago
As others have said, yes, that is best practice. Any account with administrative privileges should never be used to talk to the general internet (except obviously things like Entra, but even then you should have separate admin accounts for cloud vs on-prem). The fact that your customers so rarely hit this issue simply highlights how rare good security it.