371
Just let me do my job (lemmy.world)
submitted 2 months ago by to c/memes@lemmy.world
24 comments fedilink hide all child comments
 

all 24 comments

sorted by: hot top controversial new old
[–] 85 points 2 months ago* (last edited 2 months ago) (12 children)

Y'all joke, but when that 'task' is run through process monitor, we see it's trying to overwrite a DLL in system32, create a directory at root of %systemdrive% or cache some data in the Program Files application itself, instead of utilizing ProgramData or Appdata properly.

When applications fail these simple practices and demand local admin, they shouldn't touch your network.

<3

  • permalink
  • fedilink
  • source
  • hideshow 12 child comments
    •
  • [–] 17 points 2 months ago (4 children)

    LUA Buglight is also good for documenting why a program needs admin when it shouldn't.

    After that, you just write an admin shim with the app compatibility toolkit and just add write perms to the necessary folders.
    ...Unless it's system32. Then your software request can die in a fire, and I'm forwarding the info to your boss (and mine) before you can complain to them.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 2 points 2 months ago (3 children)

    Can you please explain to the laity what the problem with System32 is? So we know why to avoid it

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 4 points 2 months ago (2 children)

    It is the beating heart of Windows itself, the nuclear reactor at the heart of the facility. And much like with a nuclear reactor, you don't screw around in the core unless you have a damn good reason.
    Doing so at random is a good way to make both go kaboom.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 24 points 2 months ago (5 children)

    As an insane person who moved all my folders to the D drive, it’s absurd how many big companies hard code C:\Users\you\AppData\Roaming

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 3 points 2 months ago

    The hardcoded AppData path is the main reason I had to spring for a larger system drive a few years ago despite not installing any programs to it. Gradle/NuGet/every other package manager were the main culprits, with Microsoft themselves coming second. Every few months I'd clear out their caches and "temporary" file folders and it'd free up tens of gigabytes.

    I'd mess around with symbolic links to move it to another drive if I didn't half-expect Windows to break them at some point.

  • permalink
  • fedilink
  • source
  • parent
    • [–] 35 points 2 months ago

    Sorry, gonna need a ticket to escalate that

  • permalink
  • fedilink
  • source
    •
    [–] 12 points 2 months ago

    The holy war between good (IT) and evil (npm) but my feature needs to be out end of month and I can't have everything installed immediately blocked or I won't meet the deadline

  • permalink
  • fedilink
  • source
    •
    [–] 8 points 2 months ago* (last edited 2 months ago)

    everyone thinks they can pull it off just fine, but believe me, it's not a bad bet that your IT dept knows better than to bend to someone just dangerous enough to be a problem. it's probably happened before and that's probably why the policy is in place.

  • permalink
  • fedilink
  • source
    •
    [–] 19 points 2 months ago (6 children)

    IT tried to get super strict with that at my company, but they relented when ticket volumes went up by a couple thousand percent.

  • permalink
  • fedilink
  • source
  • hideshow 6 child comments
    •
  • [–] 4 points 2 months ago (4 children)

    We have done this, and it took years.

    We audited every exe and whitelisted like majority with over 50 users. Some occasional victims here and there (I lost access to my self compiled ones, too) but overall no THAT signigicant rise in ticketing

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 8 points 2 months ago (3 children)

    I do industrial controls. The software we are forced to use is usually proprietary, sometimes old, and always very poorly written. Plus there's the networking issues. A huge amount of stuff is just statically addressed, so I might be switching the ethernet port on my laptop from an 89.89.x.y subnet, to a 10.10.i.j subnet, to a 192.168.a.b subnet, and back again multiple times a day. When IT first took admin rights off our laptops, it took away our ability to change IP addresses. There may have been some small amount of malicious compliance.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 2 points 2 months ago (2 children)

    approximately how many windows XP instances running CNC shit do you support?

    seeing these in the wild blew my mind

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 2 months ago (1 child)

    Haven't come across many of those, since we tend to do small to medium sized production line type machines, as opposed to individual CNC stuff. That being said, it is wild how hilariously insecure everything is.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
    • [–] 2 points 2 months ago

    Heh. At my $dayjob we develop software for automated permission audit and revoking/granting.

    All is fine until it isn't. Security really is a bitch.

  • permalink
  • fedilink
  • source
    •