Questions[sysadmin](server)

I am a SaaS developer who has a popular website that services users in financial institutions. As we have grown i have noted that an increasing number of our end users are having downloads or uploads blocked due to corporate IT policies and / or software.

To help mitigate this issue we want to create a help article in our help center that outlines the common scenarios when this happens (e.g. you work at a bank, are on your work computer, you get this type of error).

What I don't know however is if there is specific (popular) software that would be on these computers that i can reference? (e.g. if you are running MalwareBytes do this..) - is there common software controlled by sysadmins that prevents downloads / uploads? or is it just group policies or specific config applied to browsers in a disk image or something?

I'm running a Rocky Linux 8.4 workstation with GNOME and MATE desktops, but I've seen the same problem on CentOS 7.9...

When I log into the machine on the local display, I can do things like administer users and set the system time using the Control Centre app (this on MATE, the tools are buried in the menu on GNOME). When I click on the tool I'll get a popup asking for my password, or there will be an "unlock" button to click before I get authenticated. This all works because my user is a member of the "wheel" administrative group.

However, when the same user logs in to the same desktop environment over xrdp, the ability to administer the system has gone. In some cases the "unlock" button is greyed out, in others when I click on the tool app icon I get a message "Error executing command as another user: Not authorized" in my .xsession-errors file.

As I understand it, the problem is down to polkit treating local and remote sessions differently, and basically blocking administrative actions from remote sessions such as xrdp, vnc etc. This is a pain, because the main reason for setting up the xrdp service was so that I could administer the machine remotely! I can work around this to some extent using sudo from a terminal, but really I want it to Just Work™.

So my question is - how do I configure polkit to treat a remote session for my admin user identically to a local session? (Always assuming that polkit is the source of my problem!)

Let's start by setting the scene -- I'm a junior systems administrator tasked with conducting a transition of the company towards a "Least-Privilege" model. This includes removing admin rights from our users, who mostly work with Windows 10.

Now at this point in time, users are (for the most part) using accounts with local admin rights. This is obviously pretty bad, and we're working on changing that. The idea that was put forward by my n+1, following a security audit they've had last year, is to have two types of users:

• The first type will lose admin privileges and, in the event of needing them, will receive a temporary password to an account with admin rights on their computer (which will expire after a bit of time, using LAPS)
• The second type (and most relevant to my issue) is made up of developers -- some on web technologies, but others on some very low level languages, and needing to interact with the registries on a semi-regular basis among other things.
  These guys will have a regular account, with no privileges, and an admin account (or "Run as" account) they will use when they need to run stuff as a local admin. This means entering a login and password everytime the UAC comes up to confirm admin privilege usage. This "Run as" account will not be able to open a regular session, for obvious reasons.

The problem comes with these old-school developers. I'm afraid this will be turned into an office politics issue, since the loss of admin rights might come with a bit of productivity loss (especially for those who use privileges more often) and, more importantly, some frustration.

I can understand where they're coming from. Having worked for the same company as a dev, I get that being local admin is comfortable. However, I'm also familiar with security issues, and know that being an admin on a workstation is a big no-no.

Recently, I've had to present to this second type of user our plans for the future. Needless to say the lead dev of the "old-school" group was not happy about it, and he asked a pretty good question (though maybe coming from a close-minded point of view on the situation) to which I haven't managed to come up with a satisfying answer.

If the purpose of not being a local admin is to avoid the spread of malware or the capabilities of an intruder to exploit vulnerabilities, is there a real difference between a user running privilege-needing programs as this "Run as" admin account and just executing it outright with an admin account in the cas of an infected file?
The lead dev argued that such a policy would be nothing more than a waste of their times, since it would result in the exact same security vulnerabilities as just being a local admin in the first place.

Is this accurate? I'm aware of the claims that "92% of critical Microsoft vulnerabilities disclosed in 2013 can be mitigated by removing admin rights"(SANS, 2016, citing an Avecto study) and other such assertions, and I really feel like being local admin is indeed not a good idea, but is our solution really better?

We're planning on doing a test drive of the new solution in the near future, to assess the potential loss of productivity and determine whether or not we need to find another solution, and I'm afraid the lead dev and others who are annoyed by the idea will purposefully overstate its setbacks.

I have some servers that do a lot of file zipping operations. This also means that all the files have to be remotely downloaded first before being zipped and remotely uploaded, or remotely streamed to clients.
I have the option of either upgrading old servers or getting new ones.

The old server specs are about 3.1 GHz and bandwidth averaging 100 Mbps. The new server specs are about 2.4 GHz and the bandwidth guaranteed to be 1000 Mbps up to 2000 Mbps. Memory usage should remain the same or be reduced in the new iteration.

At this point, I have figured out my RAM and Disk usage. That is not an issue. The question leans on how CPU speeds and bandwidth affect streamed downloads.

Those are my options.
Which option is better for my use case?

I was thinking that through one Windows Admin Center installation I'll be able to manage several remote Win servers. However, the add server dialog seems to be able to find only local/LAN servers. Is this somehow possible or do I need a separate WAC installation on each server thus each will have its own address?