In Windows Adding a domain account to the local administrators group. What problems can arise?

Question

I work as an IT and every employee in my company has a domain account (Windows server 2003). Many people want to install new software for their professional needs and I have to be there just to write the Administrator's password.

It is very annoying and I decided that I would give some users the privilege to install new software (only to people whom I trust and whose computer abilities are above average, so I know they won't install stupid things or viruses).

I discovered that the only way I can do that, is to add their domain user account to their PC's local administrators group. I am a bit reluctant, because I don't know what the downfalls of this strategy might be.

Can you provide me with a few scenarios where this move would be a bad idea? I repeat that I will give this privilege only to people which I know that will not install harmful software.

Answer 1

Imagine the worst that could happen to the computer. This is what can happen by granting your user administrative privileges. You're giving them the master key. Are there any changes you don't want your user to make? It doesn't matter. You can't stop an Administrator.

They can undo, work-around, defeat, and bypass anything you put in place on the computer. This includes circumventing Group Policy in a domain environment.

Further, any malicious software they encounter will inherit their administrative permissions and it too will have free reign over the computer.

If there's any good news in this it's that their administrative permissions apply to the local workstation only. Being a local administrator on one computer doesn't grant a user administrative permission on another computer.