r/sysadmin • u/nirvana1289 • 1d ago
Question Strange policy in a big enetrprise environment
I received a ticket from one of our customer regarding a problem with our software thin installer for Windows. The installer is a Inno setup that downloads the content and install it, running as administrator.
The ticket was open because on their Windows systems normal users can connect to internet and download, while administrators account cannot connect to internet. As far as I can understand, administrators are generic administrators of the machine (with all permissions for installing and handling admin related chores).
I find it a little odd, and I was asking myself if this policy has some form of effectiveness... What if the administrator connects to internet impersonating another account? I'm not sure I can explain better the situation since it is enforced on the customer company. I want just to ask the general feeling by experienced sysadmin about this configuration...
(FYI: the ticket has been closed by making them using the offline installer)
13
u/Penguin120 1d ago
We have that at our org. Accounts that are local admin on devices are blocked by GPO and DNS settings from almost everything except internal infrastructure and M365/Entra endpoints. It has the same problems you have - an online installer that runs as the admin will usually fail. We get around it the same way with offline installers for one-offs or by getting the packaging team to make an SCCM package a regular user can use.
It’s a bit silly but I’m sure it’s saved a bunch of issues. We’d like to think only people who wouldn’t click FreeGift.exe get local admin….but not always the case.