Administering without Administrator Account

[dp]

My fellow ITers...

I'm stuck in a peculiar situation- I am supposed to run, and support a
Windows2003 server and 5 accompanying workstaitons. This server is to be
under the umbrella of the domain "ABC". The person who is supposed to be
administering this for us has our addresses set up as (e-mail address removed),
(e-mail address removed), etc. and the servers are accessed like \\abc3.abc.org Where
abc3 is my server. The person who installed this, created me a user
account, and then granted that user administrator (some administrator?)
functions. I can't tell exactly what I can, and cannot do. There are also
5 workstations in my group, which this guy has installed, however he hasn't
told me, or any of the people using the 5 workstations what the admin
password is for their workstations either.

What gives here? This doesn't sound like good IT policy- When *I* am god,
if someone doesn't need Administrator, then I don't give it to them, but if
they DO need administrator, I don't fiddle around, I let them have access,
and tell them to be careful what they do.

A layperson asked me "Well exactly what is it that you need the
administrator account for?" I was at a loss really to come up with a clear
concise answer, I mean, I know what sorts of things I do with the
administrator account, looking at print queues, setting up workstations,
administering other things on the server.

Is it really possible to administer without the Administrator account? I'm
I justified in thinking that I ought to have the administrator password for
the server I'm administering? At least to the administrator account on that
server..

What is a good lay person response to why we need to have the administrator
account for the servers and the workstations? My first reaction would be,
"BECAUSE WE CAN'T GET ANYTHING DONE!" But I suppose that is too general.
Anyone got anything else?

-Brian

 

[Guest]

kind of hard to administer without administrator
password...If it were my network i would recover the
passwords and change them..Security first..We had a
similar situation where a vendor actually accessed the
machines remotely without permission which can be done if
they have proper passwords...

 

[dp]

I can't tell if this guy is messing with me or not. He plays the snob-IT
game very well- "Allowing Administrator access for everyone is not part of
best practices blah blah blah.." As far as I'm concerned he can keep the IT
babble to himself. I just want to get in there to diagnose why this server
seems to be running slowly, and be able to add and remove programs without a
problem.

He claims he has added administrator access to my account - And I could
create a user on the one server - so is that the same thing as having the
administrator password? If you grant someone administrative rights, is that
the same thing as actually being logged in as administrator? I can't put my
finger on it, but it seemed last night when I was trying to get stuff done
that it kept asking me for the administrator account, or that only
administrators can do this or that. If I'm wrong, and that just assigning a
user to the admin group is the same as having the administrator account and
the password, then I guess thats fine.

-Brian

 

[Andy Vaya]

it's the same

I can't tell if this guy is messing with me or not. He plays the snob-IT
game very well- "Allowing Administrator access for everyone is not part of
best practices blah blah blah.." As far as I'm concerned he can keep the IT
babble to himself. I just want to get in there to diagnose why this server
seems to be running slowly, and be able to add and remove programs without a
problem.

He claims he has added administrator access to my account - And I could
create a user on the one server - so is that the same thing as having the
administrator password? If you grant someone administrative rights, is that
the same thing as actually being logged in as administrator? I can't put my
finger on it, but it seemed last night when I was trying to get stuff done
that it kept asking me for the administrator account, or that only
administrators can do this or that. If I'm wrong, and that just assigning a
user to the admin group is the same as having the administrator account and
the password, then I guess thats fine.

-Brian