[oz]

Most sysadmins don't want to give users admin rights on their machines. But the problem occurs when there's software (especially software written for previous versions of Windows) that requires admin access to run. Management doesn't wanna hear it about "privilege separation" and "principle of least privilege." Bob in Accounting needs Quickbooks to work right now.

Then, there are the senior managers who know enough to know that they want admin access so they can do whatever, but not how to protect themselves. They're gonna call your boss, who's gonna tell you to give them admin access. And WHEN something goes wrong, guess who gets the blame?

I don't miss those days...