Give Standard Users Temporary Admin Rights

[jared_f]

I saw this on twitter and thought it was interesting. The app "Privileges" was developed by Rich Trouton and his team at SAP. Once installed, the app allows users to click it and upgrade there account to an admin account and then it demotes after 20 minutes. 

Here is the Github link:

https://github.com/SAP/mac-enterprise-privileges

Would anybody here deploy this?

[PhilipDAth]

What's wrong with sudo?

[jared_f]

@PhilipDAth Nothing is wrong with Sudo. I execute everything I do remotely that doesn't need to be done on the user level with Sudo. This is more of an end user app. For example, a user needs to install software and doesn't have to put in a request to do it. It gives the security of only having standard users, but having them be able to lift it when they need it.

[BlakeRichardson]

This is something I am interested in trialling with Staff at my workplace. I will be bringing this up in our next team meeting i think and will get some of my guys to test it out.

Thanks @jared_f

[Adam]

What are some use cases where you need people to have temporary admin access?

[BlakeRichardson]

@Adam staff might want to install software (we are happy for them to do this) but would prefer they don't adjust system settings. 

We currently have our users as standard accoutns but they have a seperate admin account on their machine which they can use.  The thing i like about this app is the 20 min timeout. 

[Adam]

@BlakeRichardson but conceptually during that 20 minutes they can still adjust system settings and whatever else they want right?

[BlakeRichardson]

@Adam Yes thats correct. The benefit that I see for this is less work in reagrd to setting up for my department. 

This is one of the pitfalls of they way Apple deals with security poilicies. Its all of nothing when it comes to being an admin whereas Windows is a bit more flexible. 

[jared_f]

Using configuration profiles to block out certain system preferences (i.e. profiles) and restricting certain software (Disk Utility, Terminal, Etc.) is good for keeping most things that aren't allowed to be touched protected. In addition, having policies and email alerts in Meraki are helpful. It seems that Meraki is no longer looking to add features to the MacOS side, but a kill function for the running programs would be helpful. I have been personally trying this app, and I think it is nice to have standard users be able to elevate their privileges to delete apps, run installers, etc.