Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I work at a Fortune 500 company as a Windows software developer in R&D. Corporate IT is currently gearing up for a company-wide Win7 deployment and as a part of it they are looking to completely lock down admin rights on all boxes (including our dev workstations).

I've been tasked to work with them to make the transition as smooth as possible. Lucky me.

I'd like to know if there are any published or other highly respected resources out there that I can use to:

  1. figure out where to draw a line in the sand
  2. back up my position.

Personally, my take is that we're R&D and our job is to do things that are 'out of the box'. Thus we need admin rights. However, having started my career as a Windows Admin, I'm aware of their goals and what they need to achieve. What I need to figure out and back up is a way to build the environment in a way that both IT and R&D can live with it and continue to perform their jobs productively.

Development VMs with local admin rights will definitely help a lot, but not in all cases since we interface with lots of custom hardware.

The CIO pushing these changes is definitely a 'pure IT' kind of guy with limited knowledge of the development process so I need some references that would be appropriate to share with someone like that.

I'm not looking to gather a lot of personal opinions (a lot of which have already been shared here), I really need whitepapers, magazine articles, scholarly works, etc to use to make a strong case to upper management.

share|improve this question

migrated from stackoverflow.com Mar 26 '11 at 10:51

This question came from our site for professional and enthusiast programmers.

1  
Related (but no research references there that I can see): programmers.stackexchange.com/questions/4596/… –  Anna Lear Mar 26 '11 at 18:25
add comment

6 Answers 6

Because you are going specifically to Windows 7, you should push hard to be admins on your own boxes. There are two really good reasons to keep developers from being admins:

  • the same reason you keep everyone else from being admins, so that malware doesn't do really awful things if it happens to run
  • so they won't write apps that only work if you're an admin

With UAC, neither of these things will happen, since apps you launch won't run as admin unless you deliberately ask them to. Thus there is little risk to letting you have an admin account.

Some bosses have a third reason - I don't want you installing games or unauthorized tools. Without discussing the merits of this reason, I will observe that it usually remains unstated. You need admin access to install the stuff you're writing, to configure IIS, to reconfigure your machine for various kinds of testing (eg editing your host file) and the two "real" reasons for avoiding admin access no longer apply for Windows 7. Therefore, you should be admins.

share|improve this answer
add comment

Honestly I think it's going to be a tough case to make. Once upper management makes up their mind it's pretty difficult to get them to change. If they allowed more privileges on your machine, someone else might be able to access and perform the actions this whole plan was designed to prevent.

These may help:

PS: Best of luck!

share|improve this answer
    
Thanks for the reply. I'm aware of the goals they are trying to accomplish (I started my career in IT / Server Admin). What I'm looking for is a way to build the least restrictive environment that both IT and R&D can live in and continue to do their jobs. –  Dan Mar 25 '11 at 14:08
add comment

One option is to ask for test workstations that do allow administrative access.

Another option is to do exactly as they say. Then when the next project comes along, you won't be making any progress because you have to go to IT for every small change. Explain this to the project leader, and he'll arrange for admin rights quickly.

A third option is to check if your department is represented in the Win7 migration project. If it is, contact your representative, and ask if he can add administrative rights to your department's requirement list.

A fourth option is to trade. The migration project typically needs development to update their software for Win7. It might be possible to condition a supportive attitude on admin rights in the new environment.

share|improve this answer
3  
Doesn't work - it just means you have to do your job without things like debuggers, and it's your fault for being slow –  Martin Beckett Mar 26 '11 at 15:24
1  
@Martin Beckett: Well, colleagues one floor down had this problem. They went for the PM approach, and the PM arranged for local admin, faster laptops, and bigger screens. –  Andomar Mar 26 '11 at 15:35
    
Depends on who's enforcing the no-admin policy and how strict they're going to be. If (as in the case here) it's the CIO, and he's not from a development background, it would be better to make the case that there should be exceptions, rather than assume you can get one. –  David Thornley Mar 28 '11 at 14:09
add comment

From a pure IT perspective and a development perspective, many companies solve the problem in this manner:

Put all development boxes on a separate network. The development network might be completely isolated (no internet and no intranet). In this case, the developers have a separate corporate box that is used for email and official communications--i.e. access to both the internet and intranet. This solution has its own challenges as certain IDEs (like Eclipse) and other development tools assume you have a live connection to the internet to get updates and plugins. Still the large majority of development tools know that isolated networks exist.

Another variation of this approach is to have the dev network on a sub-net. You have indirect access to internet and intranet through a strict DMZ firewall, but still the developers have local admin access.

share|improve this answer
1  
+1 for separation, treat dev like remote users and it tends to assuage corporate IT pretty well. –  Wyatt Barnett Mar 28 '11 at 15:15
    
"no internet" you mean they schouldn't be allowed to use Stackoverflow on their dev machines?! –  mbx Jul 1 '13 at 9:28
    
Correct. Separate machines for internet and devopment –  Berin Loritsch Jul 1 '13 at 10:58
add comment

I can't imagine trying to develop without being a local admin, however I think the needs will vary depending on development tasks and how standardized the development process and toolchain is at your workplace.

From my experience, there are usually senior development staff that will need to install various dev tools (sometimes at odd hours) to rapidly prototype or troubleshoot some critical issue. They almost certainly need local admin access to install, debug, work with services, etc.

The remaining staff may be able to get by without it, if your toolset is fairly constant, and depending on what they develop/debug/deploy. My suggestion would be to get a small set of your most level-headed senior dev staff together, explain the issue and their options, and have them take a couple days to consider it, and then have a planning meeting to determine what kind of access the staff should have.

share|improve this answer
add comment

Can you use a virtual environment?

If you aren't doing graphics heavy stuff then running MSVC in vmware or virtualbox is fine (if you have lots of ram) then you can have admin in the virtual environment and 'their' install is locked down

share|improve this answer
2  
The opposite might work better: use a corporate workplace in a virtual environment. Corporate IT usually provides this for managers anyway, and you only use it to read and send email. –  Andomar Mar 26 '11 at 15:36
    
yes but if the problem is not letting you have admin rights to run a debugger or test installs that doesn't help –  Martin Beckett Mar 26 '11 at 15:42
    
Well the idea is that the virtual server is on corpnet, but you are not. So you can be local admin –  Andomar Mar 26 '11 at 16:00
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.