Today I talked to some peers and noticed that a lot of MSPs out there still give their technicians local admin privileges to their machines.

When I stated my concerns and told them that none of my technicians have local admin privileges on their work machines, everybody was shocked and claimed I have trust issues. Why, though?

It’s not about trust, it’s about risk. What reasons are there to give them admin privileges to their own systems?

Need to change IP address? They can, they are member of the local network operators security group.

Need to install software? No, software comes through Intune and company portal.

Need to install Powershell Modules? No worries: -scope CurrentUser

Need to test elevated Powershell Scripts? No worries, HyperV is installed through Intune. Go ahead and spin up a VM.

Got something really special? Use request by admin. I will gladly approve if it’s needed.

People and especially technicians need to understand that they can do almost everything they need to without being a local administrator if everything is set up correctly.

Feel free to change my mind!