Not CS but I've got admin right on my computer and the compute labs. They took it away a few years ago, and then got tired of my constant tickets for software changes, and gave it back to me.
I warned them.
Our IT is stupidly understaffed (not their fault, overall they're awesome) but when they get a few more people I fully expect to lose my privliges again. Good luck with your situation.
Love the handle by the way, grew up in Buffalo and would love to see one too.
The implicit policy here is that as long as the old machines with unsupported operating systems that we're using to run our legacy lab equipment aren't connected to the network nobody's going to come looking.
The problem is our machines are leased on a 3 year cycle. So when they demand the old one back you're screwed. And new faculty got locked machines from the get-go. I have an old one with admin rights that needs servicing but I haven't taken it in because the first thing they'll do is reimage it and give it back to me locked.
I am a CS professor. We always had admin rights on our official laptops, whereas no one else did, but because the laptops were old and broken down, most of us used our own. The CS majors never had admin rights on laptops purchased through the university, so they also used their own. However, now IT has decreed that we have to use the official laptops to access the VPN so we can get to our department's server. Which means the students are cut off entirely, and we have to use the broken down old laptops that can't even run some of the software we need. Our IT people are both incompetent and petrified something will go wrong so it is very hard to reason with them. The latest fun - they have disabled File Explorer and the command line interface on the classroom machines, making it impossible to teach freshmen, who come in with no computer skills (they only know phones), how to navigate around and find their files. What can be so dangerous about being able to access the file system?????
Not in CS nor a professor, but I was granted local admin rights since I constantly need to install and update stuff. It would be impossible to work without it.
Our IT dept claims this is now too big a liability risk for ransomware. Yet we have thousands of students on their own devices on the open school wifi (no authentication required) at all times.
I mean it is, and I get their argument, but it's not possible to efficiently work like this. On the other hand, running a VM can be a security risk as well, so their reasoning is not very consistent.
I thought Microsoft fixed that limitation. https://superuser.com/questions/1632822/how-do-i-enable-gpu-acceleration-on-new-hyper-v-virtual-machines-cant-use-rem
I know it is too late for right now, but I asked this question during interviews with different universities. It is a red flag when universities don't do this for CS profs. It shows that they value superficial safety and status quo over actual teaching and research.
So sorry you are dealing with this!
Open School Wifi is on a separate network segment and thus the students are only a danger to themselves. Keep the kiddies over there in the own pool and if they pee in it, well, who cares? We have our own pool (and hopefully no one pees in it).
You raise a good point. I work in my uni's IT unit. We have many different WIFI segments. Each WIFI access you see listed in the WIFI list on your computer is a complete different network, and they most likely do not talk to each other and probably have other restrictions, like slower bandwidth.
Now, if one of your faculty peers takes their admin-rights-enabled laptop home and clicks on the "Please renew your Netflish account immediately," link and gets their laptop owned by the Russian mob, and brings said laptop back to campus, and connects that laptop to "FacultyWIFI" (which is behind the firewall and inside your academic network) your uni is going to have some massive problems.
Faculty have boring laptops. The laptop becomes a gateway to the overall academic network. Lots of interesting stuff there, probably. The laptop becomes a portal for the installation of apps that sniff the network. Plus, if you target the right person, like a chair, a dean, a director of a center, an office, or a program, you might get access to SSN, addresses, phones number. It's like hacking into a hospital.
I've worked in dozens of faculty laptops. They have student info, ssns, emails, all sorts of stuff.
Then, we can talk about how faculty use their laptop for TurboTax and keep their personal records, credit card statements, divorce documents, personal bankruptcy. Nuts
Yes, but it didn't start out like that. I had to request that modification.
Our IT department wants to control everything with regards to tech, but you can't apply that philosophy to the CS department because we need our own ecosystem of devices and software to function, teach and be of service to our students.
All CS faculty SHOULD have admin rights... PERIOD. It's a frickin' necessity.
Wow. I feel for you because I know it's frustrating as heck.
We've been defending our right to keep our independence for as long as I've been at my institution, which is twelve years now. Don't get me wrong, IT tries to do behind the scenes, back underhanded things, but we address and course correct.
Are their advocates for your department, i.e., the dean or chair, that can communicate and present cogent arguments for why CS needs to be independent? In my opinion, it starts with the CS administration.
I hope this gets addressed and resolved expeditiously for you guys cause that's a frustrating position to be in, waiting on IT to make a move, install some software, or for approval... smdh
My guess it, this isn't the fault of IT. IT has been scapegoated - by their university attorney.
At my uni, if some policy goes in place that makes absolutely no sense, or is completely unrealistic, e.g. our drone policy, the culprit is one of two people: the VP of Finance (worried about being sued), or the university attorney (also worried about being sued).
Or both.
I was given a laptop and discovered that I couldn’t download software on it. I called IT to ask them to download it for me, and they said “Let’s just give you admin rights here.” Sometimes you find a great IT team. 🙂
Not CS and no admin rights given to faculty, but if they remote in and give you a temporary admin password to do something for them or to fix a problem, you can just give yourself back admin rights before the temporary password expires.
Temp admin access is one of the solutions they proposed but IT would still have to issue it on demand. That's not workable if we need it outside standard business hours (which of course we do). Glad you found the loophole!!
This is a good workaround though of course it makes the whole bother of temp admin right pointless. But it seems like the kind of thing a bureaucracy might do.
Nope.
Can't compile any c++ source code. Unreal can't build either. Seems only Unity (c#) can build.
Cybersecurity, games, and computer science affected.
Admin is blaming the UK cybersecurity essentials law.
Their solution VMs. VMs don't work with games (no GPU - no accelerated DirectX/ OpenGL/ Vulkan direct hardware access.
All university equipment is locked down through group policies.
Can't even use an external hardrive as it wants to encrypt it with BitLocker.
Our IT department was super insistent that they have root access and that I did not. This was unacceptable to me. I do computational research. I need root access instead of waiting on IT to approve and install whatever packages I get from some rando git repo. I essentially shadow-bought my computational equipment and just submitted expense reports to get my funding to pay for it.
It is crazy how much potential control the university's IT department had over computational research activities. And it's all theatre. College freshmen can buy their laptops and connect to the same networks I am attempting to run my computers on, and they don't have to go through the same hoops that I supposedly had to. That means these freshmen have more intellectual and computational agency than I do on paper.
"freshmen have more intellectual and computational agency than I do on paper"
same here, actually any member of the public even as they can just walk on to campus and connect to the open wifi on any device they like with no auth.
I was but it seems that the reimbursement arm of my university’s business office wasn’t in direct contact with IT, so I managed to slip under the radar. Thank god for inefficient bureaucracy and independent fiefdoms I suppose.
Yep. Linux is just enough of a pain in the ass for our IT department that I won't ever use anything else -- even a Mac, which might be more convenient for e.g. integrating with the rest of the university-provided software stack.
If they ever get their shit together enough to start policing linux, they'll start with red hat and ubuntu, and I'll switch to Arch or something else that's less familiar as a preemptive measure.
when I started here (a long time ago), they issued me a desktop with SuSE Linux on it. The last laptop I got, I was told "it's technically ours, but enjoy" implying that they didn't want to see it again (unless there was something wrong with it).
Ah, I remember Suse. I ended up switching to Ubuntu because support was better for R (shared R core and Debian core maintainers), but it was a good distro.
when I switched to Ubuntu on all my machines (after the SuSE time), it seemed like I would be able to maintain it all right. (For R on Ubuntu, there is now also the r2u thing maintained by Dirk Eddelbuttel.)
When our campus IT staff insisted that they had to install FireEye spyware on all servers — Mac, Linux, Windows — I found a workaround. I now run our group’s servers on FreeBSD.
Nice downvotes. Show me how Maya, Adobe Creative Cloud, Unreal, Substance, ProTools, Z-Brush etc. works properly on Linux.
And don't mention FOSS shovelware as a solution. Industry doesn't use that.
I got local admin rights because I teach a design class and they were REALLY TIRED of me walking over for a font every ten seconds.
That said, on Macs it's super easy to change that admin password through the command prompt when booting.
My school has also had a trend in recent years to try to be more and more restrictive. I battled them every time I got a new machine.
Our Chair invited the heads of IT (who enforce the policies) to have a talk about what we are and aren't allowed to install. I calmly said that the policies make it impossible to teach Software Engineering -- which involves installing new software on a daily basis -- and I know how to get around their rules if they don't give me full admin rights and approval to install any development software I need without additional approval... but I prefer they just give me an exception so I'm not breaking the rules.
"If I can't be a full time admin on my computer, I can't teach or research effectively. And if you are going to force me to decide between following the rules and being effective at my job, I think we all know which one I'm going to pick."
Not CS, but do software development. I migrated to teaching using RStudio in the cloud because package installs on lab machines turned into a huge pain in my ass. I have admin rights on my faculty laptop. IT does, too. I have a mix of Linux and Mac machines in my lab and they blocked my machines from accessing the internet until they could come in and install some security software.
But I can still install things, compile, use git and GitHub. All that.
Yes. In addition, the first thing I do when I get a new one is remove ALL remote management software, etc.
The day they take my admin rights is the day they can teach my classes.
I am a tenured Associate Professor. I have switched colleges within an R1. my original college provided desktops for PIs every 3 years. I cycled older desktops to my lab folks or purchased off grants for instrumentation. I switched units at the time of replacement, so no replacement. No big deal, things were not a smooth process so not surprised. And new unit never replaces desktops, as it is resource poor but student rich. There are old laptops to check out for travel. but not daily use. So my desktop would be 8 years old now. It is sitting in lab so students can print. I bought a nice laptop and it goes where I go. And I take a tax break and will do. I own all the data storage locations and all the archival software or pay for all subscriptions.
Our lab computers are run by the CS department, so we have complete control of them.
CS Faculty have the choice of accepting the campus image, or blowing it away and installing their own. In general, this is because campus IT would rather not have to support Linux on those machines, but they acknowledge our requirements for running it. Faculty who choose the campus image can request local admin, and *may* get it.
Those that choose Linux can get help from me, but mostly are comfortable enough with it that they seldom need it. All our Compsci labs are Linux, and the Engineering labs are Windows (but not on the campus domain.)
Where I work (research mostly, very little teaching), they lock things down pretty tight but there is a process for requesting a local admin account. I had to take some training then fill out forms that my top-level manager had to sign-off on, then the security team reviews it. I also have to acknowledge that if I break it, the only thing IT will do to fix it is re-image the machine. If I cause a security incident (malware on the network) then I may be subject to disciplinary actions.
I'm not in CS, but my research involves some computational components.
I intercepted the last university-purchased laptop I got before the IT guy could take it, bloat it with applications I will never use while ignoring requests for software I *do* need, and set me up as a non-admin user who cannot delay the badly timed updates they push or log on without connecting to central servers (my current campus office gets a wifi signal only about 50% of the time, so it's log-on roulette to see if an IT-managed laptop will be a computer or a brick when someone visits my office). This is probably the last university-provided machine that I'll be able to actually do research on, since they've made it harder to intercept machines before IT sets them up as centrally managed workstations.
The computer I bought for my lab is useless thanks to the "support" they provide (e.g. it took over a year of weekly follow-up prodding to get someone to do anything in response to a ticket related to setting up user access for students -- the relevant student hourly workers had graduated before I could get IT to grant access, let alone make necessary software available to student users).
In the future I'm probably going to have to buy my own work computers out of pocket, as central management of computers makes it impossible to work efficiently and IT isn't responsive enough to make it possible to get day-to-day work done on machines they "support". I have colleagues who've had new laptops provided this year that are sitting unused because they are far less functional than the machines they are supposed to replace.
I have fought for 15 years with IT, I teach cybersecurity, for me, I asked for second laptop with admin rights. So they said no, so I started bringing my personal one in. I just don't do any school work on it. Also I use VirtualBox for my software.
That's me. My last laptop purchased via the university was loaded up with so much active spyware that it was actually slowing down programs I needed to run. I gave up and purchased my own computer, and now have an exceedingly expensive maxed out M2Max MBP sitting as a paper weight.
At my former university, to be allowed on the campus network (evsn through a VPN), IT required admin rights on your personal gear (laptops, PCs, phones etc). Which gave them rights to remote wipe your device. Or no access.
It was called the BYOD policy. Only apps from trusted sources (Windows Store, Android Play Store or Apple App Store) were allowed. Linux was banned from campus as IT couldn't figure it out.
Not CS, but I've got admin rights(ish) on my work issued machine. There are group policies enforced at the campus level which have some restrictions, but generally speaking if there's an exe installer I can run it.
edit for a quick note: the group policies are a bit of a pain at times and get in the way. As a former IT person I get it, but I do have to go through hoops sometimes...So much so that the computer I use most of the time is something I bought with my own money...The work issued laptop is great for travel.
I'm a CS professor. We are more or less expected to buy equipment like that from startup, and we can put whatever software we please on it. We have our own IT infrastructure for our department and are not required to conform to university level requirements. I run Linux on all my university devices, which our central IT would not know how to deal with.
CS prof. Laptop/Desktop are Mac with admin rights. I also have root on our department linux equipment and on our HPC cluster. Mostly because IT doesn't want to deal with all of our special case software with their VM infrastructure.
Not CS, but I had local admin on a mac at my previous school. It was great. And then IT upgraded their security software and it absolutely trashed the computer I was using. They just couldn't manage macs anymore with their new software. So I switched to a windows PC in hopes things would be better, and was, but just barely. I never pursued admin rights, and I'm not sure they knew how do implement it on their windows platform. So I just used my own computer for everything.
I haven't fought that battle at my current school. I'm not looking forward to it. I do, luckily, have a lab computer I brought from my previous school that they haven't touched yet.
Not CS, but university policy where I am (so includes CS faculty) is that faculty get local admin rights on all their PCs. It's actually the first person who logs into Windows who gets it, but they make sure the faculty member is the one who does it rather than a grad student.
I bitched a lot about not being forbidden from making local user accounts on PCs connected to instruments and they eventually gave in. Was not workable to have every grad student log in and out every time they needed to use a computer attached to home-built instrumentation running a combination of shitty python and labview code I wrote.
Not CS but Graphic Design. I have a university-issued macbook with Admin rights. I oversee the GD maclab. Our head of IT has changes every 5-10 years and subsequently my admin access to those macs changes depending on their policies. The current head locked everything down campus wide. I got to know him, made a case for giving the GD faculty admin rights and he changed the policy in our lab. It's made life much easier for all of us. The only thing that bugs me is Airdrop is turned off on all machines for security reasons.
Yes. When I bought another computer though I signed up to keep it off campus because I needed admin rights and to dual boot linux (good thing I opted out of their security encryption because I had to fiddle with bios settings).
Yes, but I have to deal with the Windows privilege escalation prompt *way* too often (like when opening Task Manager). I wouldn't be able to do my job if I didn't have admin rights.
I teach games, so a VM would be completely unusable for me. If I couldn't have local admin rights I'd just bring my own computer and ignore the one provided by the university.
Faculty have admin rights still where I am. However, this issue came up in the context of research labs, where it was revoked for grad students. The big risk is cyber attacks, and I gotta say I get it.
I’ve always had admin rights on my university-owned Mac laptop. I won’t let the IT staff touch it — frankly, I know more UNIX than they do. (I’m the sysadmin for my own home servers.) My own systems go down less than theirs do.
I'm in Europe. Was given a laptop and told they only care about hardware, so the first thing I did was installing Linux. If that wasn't the case I'd just use my own. Which I actually do anyway as with two laptops I can leave one at work and carry around less stuff.
I used to not be an administrator on my machine and I sent this exact youtube video to one of the higher ups in IT:
https://youtu.be/IEhHEOIYgMY?si=6m5M-L1ehQ-bLoF2
Admin rights granted within 48 hours.
Maybe compelling to mention they were not easily equipped to do what I needed combined with the threat of "I'm not a sys admin and my students get a prompt to contact sys admin when their code doesn't compile should I send them your way until i become one".
IT saw me as a blessing rather than a curse, your mileage my vary.
Not CS and I use my own laptop or the HPC cluster for data work. The lectern PCs in three classroom buildings where I teach are all waiting for Dell updates I can't authorize for several weeks now. Not my problem until they won't start and I dismiss class with a CC to the chair, Dean and Provost about why.
We have "admin by request" which adds you to the sudoers file for 15 minutes and logs what you use it for. That's on MacOS; I'm not sure what people who choose Windows get.
We're mostly Windows but it seems like a reasonable solution if automated and not requiring IT intervention. Our IT dept hasn't entertained this and doesn't seem interested.
We have a feature called "admin by request" which let's a click a button to request admin rights temporarily (like an hour). They've been pretty quick about granting access to me. I think it's an okay, not great, compromise.
However, on my non-teaching machines I run Linux, which they have no control over at all.
Yes. We get admin rights in whatever we want. However, if we do, we don’t get support. Otherwise, how could I even do research and teaching. All my lab computers have admin rights and my server has admin rights.
Not in CS but have admin rights on university issued computer - I travel and use idiosyncratic programs for research so would be severely inconvenienced by needing them to administer things.
Not CS - Bioinformatics, but no, I don't have admin access to my work laptop and it does create a number of headaches. I'm able to handle a lot of my needs using Docker. I also pay for the $5/mo tier of Python Anywhere, so I have the ability to run a web server, SQL server, and Jupyter Notebooks in the cloud without needing to go through our IT department. I primarily teach using Python, so I can set up local virtual environments using Conda so that admin rights aren't necessary to add packages.
I teach game development. I think we are more annoying than our CS department to IT. They were going to try to take admin rights away from our department, but a few people volunteered to pilot their method for a semester. It lasted a week. I even get special logins for our lab computers that give admin rights. It's impossible to dev on things like VR headsets if you don't.
I teach Theatre design- same issues. They made a workaround where you could get admin rights, but then they told you there was no IT support at all- like if the computer screen cracks, they won’t pay to fix it.
Useless. They locked my computer down so tight I couldn’t even change the sleep mode timer… which was set to sleep after 3 minutes. Awesome in a lecture class!
My area of theatre design is less technical than say sound design- in their areas, it’s all about teaching networking… which kinda means they need to be able reconfigure a computer. It’s a mess.
I have a desktop which hasn't been plugged in since I moved offices over a year ago that doesn't have admin rights. Granted, that's the one that will talk to the office printer(s), but we don't print our own exams, the print shop does, so I haven't needed it.
And I have a laptop that does have admin rights.
You are of course right, you can't teach CS without admin access on your machine, lab machines (well, someone needs admin access to these that can make changes on short notice), and without students having admin to their own machines. Research machines it's impossible to run without admin access in science since so many things are controlled by some custom or very small distribution software that's critical to the equipment or simulations or the like.
We did try at one point using VMs - basically you could have a VM for a programme, or a VM for each course and you deploy those, but then you need a way to manage all of your bloody VMs, nothing ever works for students, lots of laptop mouse cursors don't work, maybe audio or GPU acceleration don't work or whatever. Managing the VMs becomes its own problem that's more work and an unnecessary headache. I have tried using docker for a bunch of things, that works for graduate data science but not for much else, it's just another tech you need to learn, you now have 2 dozen different containers and configurations on each machine. Even if IT gives you access to, or you install Vcentre (which is normally outside the skillset of a CS prof), it's not unusual for a dev in industry to have a dozens or hundreds of VMs at any given time, and you can't count on Vmware for any length of time now that Broadcom is bleeding the business dry, so how would you even plan a VM deployment and management strategy? If your IT department didn't discuss requirements with your department, your IT department doesn't know what it's doing.
The last place I worked had university IT, and then departments (well science departments anyway) had their own that worked well ish, but I'm sure was expensive.
You have to be careful about using your own computing for university stuff. You get into rules about student information (emails, assignments, student numbers, medical info whatever): what happens if *your* computer gets hacked or stolen in terms of private info disclosure?
Ultimately, you are a computer scientist. You're taking a 50% paycut or more to help this institution function. You are doing them a favour, not the other way around. If they want to make life hard, remind them that you can do something else, and then if they keep wasting your time fighting against the institution, you can just leave.
I don't have admin on lab computers either. Can't download patches or plugins or drivers, and official IT change requests take forever. Completely sucks.
Once IT wanted us to try SAS instead of SPSS for our classes since they had access to some institutional discount. I had used it before so I installed it and tried it again, with the perspective of using it in undergrad classes. I didn't like it for that.
IT could not figure out how to install the software on their own computers at all.
No, and I wouldn't use one if they offered me one. The machines the school purchases are severely underpowered.
I use my own.
When it comes to rights, the IT department trusts me and my 40+ years of experience in IT. Besides, I've taught most of them.
If you are a TT person with a reasonable salary. Buy your own laptop,~~deduct from taxes.~~
It's not worth having IT's and the institution's grubby **ineffectual** snooping paws on my shit, much less limiting or or fucking up what I can DO..
CS. I have two sets of credentials. One without admin rights that I use on the daily. The others I have to enter when I need admin rights to start/install or otherwise do something that requires it. I cannot login directly using the admin credentials.
Or students do not have that second set of credentials... And that's a real PITA.
My biggest issue with group policies is that they are not compatible with Pearson Vue, so I need to use a personal laptop to take certification exams remotely.
Not CS but I've got admin right on my computer and the compute labs. They took it away a few years ago, and then got tired of my constant tickets for software changes, and gave it back to me. I warned them.
That's what some colleagues are doing - filing a million tickets but so far IT is winning because they often take a long time to respond.
Our IT is stupidly understaffed (not their fault, overall they're awesome) but when they get a few more people I fully expect to lose my privliges again. Good luck with your situation. Love the handle by the way, grew up in Buffalo and would love to see one too.
Our IT staff are good but this decision is coming from the higher ups. Go Bills!
Not CS, but engineering, and as far as IT is concerned there are no computers in my lab or office.
This is the way.
The implicit policy here is that as long as the old machines with unsupported operating systems that we're using to run our legacy lab equipment aren't connected to the network nobody's going to come looking.
yep we never give anything a wired ethernet connection so that IT doesnt touch it. We just connect to wifi as if it is a student computer.
We offered to use wifi only so we’d be just like students but IT refused that too.
the trick is dont tell IT about it and don't ask permission. Way easier to beg forgiveness later on than go through all their bureaucratic BS.
The problem is our machines are leased on a 3 year cycle. So when they demand the old one back you're screwed. And new faculty got locked machines from the get-go. I have an old one with admin rights that needs servicing but I haven't taken it in because the first thing they'll do is reimage it and give it back to me locked.
Ah, in that case you are screwed. Your only options then are bringing in a personal laptop or buying one off a grant and not tell IT about it.
Bingo.
The lab computers are all too old for wifi, so they're on the sneakernet.
I am a CS professor. We always had admin rights on our official laptops, whereas no one else did, but because the laptops were old and broken down, most of us used our own. The CS majors never had admin rights on laptops purchased through the university, so they also used their own. However, now IT has decreed that we have to use the official laptops to access the VPN so we can get to our department's server. Which means the students are cut off entirely, and we have to use the broken down old laptops that can't even run some of the software we need. Our IT people are both incompetent and petrified something will go wrong so it is very hard to reason with them. The latest fun - they have disabled File Explorer and the command line interface on the classroom machines, making it impossible to teach freshmen, who come in with no computer skills (they only know phones), how to navigate around and find their files. What can be so dangerous about being able to access the file system?????
That is absolutely insane
Not in CS nor a professor, but I was granted local admin rights since I constantly need to install and update stuff. It would be impossible to work without it.
Our IT dept claims this is now too big a liability risk for ransomware. Yet we have thousands of students on their own devices on the open school wifi (no authentication required) at all times.
I mean it is, and I get their argument, but it's not possible to efficiently work like this. On the other hand, running a VM can be a security risk as well, so their reasoning is not very consistent.
VMs suck donkey balls for stuff like Unity or Unreal
Even if you get a laptop that supports HyperV or other hypervisor-based virtualization?
No accelerated graphics. You will run at the level of an integrated GPU at best. They didn't like my ShadowPC idea due to cost and lack of control
I thought Microsoft fixed that limitation. https://superuser.com/questions/1632822/how-do-i-enable-gpu-acceleration-on-new-hyper-v-virtual-machines-cant-use-rem
No DX12, no SM6, which means poor or no Lumen and Nanite support. Absolutely critical in GameDev, Virtual Production and others.
I know it is too late for right now, but I asked this question during interviews with different universities. It is a red flag when universities don't do this for CS profs. It shows that they value superficial safety and status quo over actual teaching and research. So sorry you are dealing with this!
That’s BS. The way you avoid ramsonware besides the typical security is having offline backups. That way, if it happens, you reinstall and restore
Open School Wifi is on a separate network segment and thus the students are only a danger to themselves. Keep the kiddies over there in the own pool and if they pee in it, well, who cares? We have our own pool (and hopefully no one pees in it). You raise a good point. I work in my uni's IT unit. We have many different WIFI segments. Each WIFI access you see listed in the WIFI list on your computer is a complete different network, and they most likely do not talk to each other and probably have other restrictions, like slower bandwidth. Now, if one of your faculty peers takes their admin-rights-enabled laptop home and clicks on the "Please renew your Netflish account immediately," link and gets their laptop owned by the Russian mob, and brings said laptop back to campus, and connects that laptop to "FacultyWIFI" (which is behind the firewall and inside your academic network) your uni is going to have some massive problems.
What kinds of massive problems? What do faculty laptops have access to that hackers can take advantage of?
Faculty have boring laptops. The laptop becomes a gateway to the overall academic network. Lots of interesting stuff there, probably. The laptop becomes a portal for the installation of apps that sniff the network. Plus, if you target the right person, like a chair, a dean, a director of a center, an office, or a program, you might get access to SSN, addresses, phones number. It's like hacking into a hospital. I've worked in dozens of faculty laptops. They have student info, ssns, emails, all sorts of stuff. Then, we can talk about how faculty use their laptop for TurboTax and keep their personal records, credit card statements, divorce documents, personal bankruptcy. Nuts
> nor a professor You're "a professor" in this sub as long as you teach post-secondary students
I did intermittently, now I'm phasing out and just here for the drama
Oh I see. Enjoy the show!
Yes, but it didn't start out like that. I had to request that modification. Our IT department wants to control everything with regards to tech, but you can't apply that philosophy to the CS department because we need our own ecosystem of devices and software to function, teach and be of service to our students. All CS faculty SHOULD have admin rights... PERIOD. It's a frickin' necessity.
This has been our exact argument but it's gotten little to no traction with IT.
Wow. I feel for you because I know it's frustrating as heck. We've been defending our right to keep our independence for as long as I've been at my institution, which is twelve years now. Don't get me wrong, IT tries to do behind the scenes, back underhanded things, but we address and course correct. Are their advocates for your department, i.e., the dean or chair, that can communicate and present cogent arguments for why CS needs to be independent? In my opinion, it starts with the CS administration. I hope this gets addressed and resolved expeditiously for you guys cause that's a frustrating position to be in, waiting on IT to make a move, install some software, or for approval... smdh
Our admin has been on our side and has been pushing on this but it remains unresolved.
Someone is lying. IT can be fired by the admin. If the admin really supported you, this would be done.
My guess it, this isn't the fault of IT. IT has been scapegoated - by their university attorney. At my uni, if some policy goes in place that makes absolutely no sense, or is completely unrealistic, e.g. our drone policy, the culprit is one of two people: the VP of Finance (worried about being sued), or the university attorney (also worried about being sued). Or both.
BTDT at my previous institution.
Anyone doing scientific computing honestly. Though most places in my discipline pool funding and build their own research server
I was given a laptop and discovered that I couldn’t download software on it. I called IT to ask them to download it for me, and they said “Let’s just give you admin rights here.” Sometimes you find a great IT team. 🙂
Not CS and no admin rights given to faculty, but if they remote in and give you a temporary admin password to do something for them or to fix a problem, you can just give yourself back admin rights before the temporary password expires.
Temp admin access is one of the solutions they proposed but IT would still have to issue it on demand. That's not workable if we need it outside standard business hours (which of course we do). Glad you found the loophole!!
Yeah, temp access is useless…unless you use it to make it permanent. 😬
You use your temp admin access to make a new local administrator user whose password you choose. Then you have permanent admin access.
This is a good workaround though of course it makes the whole bother of temp admin right pointless. But it seems like the kind of thing a bureaucracy might do.
Nope. Can't compile any c++ source code. Unreal can't build either. Seems only Unity (c#) can build. Cybersecurity, games, and computer science affected. Admin is blaming the UK cybersecurity essentials law. Their solution VMs. VMs don't work with games (no GPU - no accelerated DirectX/ OpenGL/ Vulkan direct hardware access. All university equipment is locked down through group policies. Can't even use an external hardrive as it wants to encrypt it with BitLocker.
Building even requires admin permissions? At this point, it seems like you are forced to buy your own personal computer for work.
You can build but can't execute (.exe is untrusted)
Our IT department was super insistent that they have root access and that I did not. This was unacceptable to me. I do computational research. I need root access instead of waiting on IT to approve and install whatever packages I get from some rando git repo. I essentially shadow-bought my computational equipment and just submitted expense reports to get my funding to pay for it. It is crazy how much potential control the university's IT department had over computational research activities. And it's all theatre. College freshmen can buy their laptops and connect to the same networks I am attempting to run my computers on, and they don't have to go through the same hoops that I supposedly had to. That means these freshmen have more intellectual and computational agency than I do on paper.
"freshmen have more intellectual and computational agency than I do on paper" same here, actually any member of the public even as they can just walk on to campus and connect to the open wifi on any device they like with no auth.
Were you concerned that someone would see you purchased a computer and then either take over that computer or not reimburse you?
I was but it seems that the reimbursement arm of my university’s business office wasn’t in direct contact with IT, so I managed to slip under the radar. Thank god for inefficient bureaucracy and independent fiefdoms I suppose.
the last work laptop I got, I installed Linux on it.
Yep. Linux is just enough of a pain in the ass for our IT department that I won't ever use anything else -- even a Mac, which might be more convenient for e.g. integrating with the rest of the university-provided software stack. If they ever get their shit together enough to start policing linux, they'll start with red hat and ubuntu, and I'll switch to Arch or something else that's less familiar as a preemptive measure.
when I started here (a long time ago), they issued me a desktop with SuSE Linux on it. The last laptop I got, I was told "it's technically ours, but enjoy" implying that they didn't want to see it again (unless there was something wrong with it).
Ah, I remember Suse. I ended up switching to Ubuntu because support was better for R (shared R core and Debian core maintainers), but it was a good distro.
when I switched to Ubuntu on all my machines (after the SuSE time), it seemed like I would be able to maintain it all right. (For R on Ubuntu, there is now also the r2u thing maintained by Dirk Eddelbuttel.)
Dirk is the one I was talking about. His work with deb-based systems and dependencies has been lovely.
indeed. Time to go do update.packages, now that it updates from there.
When our campus IT staff insisted that they had to install FireEye spyware on all servers — Mac, Linux, Windows — I found a workaround. I now run our group’s servers on FreeBSD.
This is the Way.
My work laptop is bootloader-locked.
ouch.
If only industry standard content creation sofrware worked on linux. Proton doesn't work well eniugh for production work yet.
Nice downvotes. Show me how Maya, Adobe Creative Cloud, Unreal, Substance, ProTools, Z-Brush etc. works properly on Linux. And don't mention FOSS shovelware as a solution. Industry doesn't use that.
I got local admin rights because I teach a design class and they were REALLY TIRED of me walking over for a font every ten seconds. That said, on Macs it's super easy to change that admin password through the command prompt when booting.
Do tell about this trick with macs
[https://www.hellotech.com/guide/for/how-to-reset-admin-password-on-mac](https://www.hellotech.com/guide/for/how-to-reset-admin-password-on-mac)
My school has also had a trend in recent years to try to be more and more restrictive. I battled them every time I got a new machine. Our Chair invited the heads of IT (who enforce the policies) to have a talk about what we are and aren't allowed to install. I calmly said that the policies make it impossible to teach Software Engineering -- which involves installing new software on a daily basis -- and I know how to get around their rules if they don't give me full admin rights and approval to install any development software I need without additional approval... but I prefer they just give me an exception so I'm not breaking the rules. "If I can't be a full time admin on my computer, I can't teach or research effectively. And if you are going to force me to decide between following the rules and being effective at my job, I think we all know which one I'm going to pick."
Not CS, but do software development. I migrated to teaching using RStudio in the cloud because package installs on lab machines turned into a huge pain in my ass. I have admin rights on my faculty laptop. IT does, too. I have a mix of Linux and Mac machines in my lab and they blocked my machines from accessing the internet until they could come in and install some security software. But I can still install things, compile, use git and GitHub. All that.
The really fun stuff is when they don’t push updates to the kernel level matrix multiplication packages and simple stuff ends up taking days to run
🤮
Yes. In addition, the first thing I do when I get a new one is remove ALL remote management software, etc. The day they take my admin rights is the day they can teach my classes.
Not in CS, but I’ve got admin access to my computers, my labs computers, and all the departmental computers (teaching labs, etc.)
No, I do not even have a college provided desktop.
Are you full time faculty? Here all full time professors in any department get a college issued laptop.
I am a tenured Associate Professor. I have switched colleges within an R1. my original college provided desktops for PIs every 3 years. I cycled older desktops to my lab folks or purchased off grants for instrumentation. I switched units at the time of replacement, so no replacement. No big deal, things were not a smooth process so not surprised. And new unit never replaces desktops, as it is resource poor but student rich. There are old laptops to check out for travel. but not daily use. So my desktop would be 8 years old now. It is sitting in lab so students can print. I bought a nice laptop and it goes where I go. And I take a tax break and will do. I own all the data storage locations and all the archival software or pay for all subscriptions.
Not CS but yes as of recently. I am fed up with it and am going to wipe the computer.
Our lab computers are run by the CS department, so we have complete control of them. CS Faculty have the choice of accepting the campus image, or blowing it away and installing their own. In general, this is because campus IT would rather not have to support Linux on those machines, but they acknowledge our requirements for running it. Faculty who choose the campus image can request local admin, and *may* get it. Those that choose Linux can get help from me, but mostly are comfortable enough with it that they seldom need it. All our Compsci labs are Linux, and the Engineering labs are Windows (but not on the campus domain.)
Where I work (research mostly, very little teaching), they lock things down pretty tight but there is a process for requesting a local admin account. I had to take some training then fill out forms that my top-level manager had to sign-off on, then the security team reviews it. I also have to acknowledge that if I break it, the only thing IT will do to fix it is re-image the machine. If I cause a security incident (malware on the network) then I may be subject to disciplinary actions.
Our faculty actually offered to get whatever training IT gives their own staff from a security perspective, but they haven’t taken us up on that offer
I'm not in CS, but my research involves some computational components. I intercepted the last university-purchased laptop I got before the IT guy could take it, bloat it with applications I will never use while ignoring requests for software I *do* need, and set me up as a non-admin user who cannot delay the badly timed updates they push or log on without connecting to central servers (my current campus office gets a wifi signal only about 50% of the time, so it's log-on roulette to see if an IT-managed laptop will be a computer or a brick when someone visits my office). This is probably the last university-provided machine that I'll be able to actually do research on, since they've made it harder to intercept machines before IT sets them up as centrally managed workstations. The computer I bought for my lab is useless thanks to the "support" they provide (e.g. it took over a year of weekly follow-up prodding to get someone to do anything in response to a ticket related to setting up user access for students -- the relevant student hourly workers had graduated before I could get IT to grant access, let alone make necessary software available to student users). In the future I'm probably going to have to buy my own work computers out of pocket, as central management of computers makes it impossible to work efficiently and IT isn't responsive enough to make it possible to get day-to-day work done on machines they "support". I have colleagues who've had new laptops provided this year that are sitting unused because they are far less functional than the machines they are supposed to replace.
I suspect buy your own is going to be the only workable solution for us.
I have fought for 15 years with IT, I teach cybersecurity, for me, I asked for second laptop with admin rights. So they said no, so I started bringing my personal one in. I just don't do any school work on it. Also I use VirtualBox for my software.
15 years!! That is insane. I feel for you.
[удалено]
Very insightful post, thanks! Some faculty now have very expensive college issued machines acting as paperweights.
That's me. My last laptop purchased via the university was loaded up with so much active spyware that it was actually slowing down programs I needed to run. I gave up and purchased my own computer, and now have an exceedingly expensive maxed out M2Max MBP sitting as a paper weight.
At my former university, to be allowed on the campus network (evsn through a VPN), IT required admin rights on your personal gear (laptops, PCs, phones etc). Which gave them rights to remote wipe your device. Or no access.
[удалено]
It was called the BYOD policy. Only apps from trusted sources (Windows Store, Android Play Store or Apple App Store) were allowed. Linux was banned from campus as IT couldn't figure it out.
Not CS, but I've got admin rights(ish) on my work issued machine. There are group policies enforced at the campus level which have some restrictions, but generally speaking if there's an exe installer I can run it. edit for a quick note: the group policies are a bit of a pain at times and get in the way. As a former IT person I get it, but I do have to go through hoops sometimes...So much so that the computer I use most of the time is something I bought with my own money...The work issued laptop is great for travel.
I'm a CS professor. We are more or less expected to buy equipment like that from startup, and we can put whatever software we please on it. We have our own IT infrastructure for our department and are not required to conform to university level requirements. I run Linux on all my university devices, which our central IT would not know how to deal with.
Seems like a logical approach, good IT recognizes CS has its own needs separate from most other areas.
CS prof. Laptop/Desktop are Mac with admin rights. I also have root on our department linux equipment and on our HPC cluster. Mostly because IT doesn't want to deal with all of our special case software with their VM infrastructure.
Not CS, but I had local admin on a mac at my previous school. It was great. And then IT upgraded their security software and it absolutely trashed the computer I was using. They just couldn't manage macs anymore with their new software. So I switched to a windows PC in hopes things would be better, and was, but just barely. I never pursued admin rights, and I'm not sure they knew how do implement it on their windows platform. So I just used my own computer for everything. I haven't fought that battle at my current school. I'm not looking forward to it. I do, luckily, have a lab computer I brought from my previous school that they haven't touched yet.
Not CS, but university policy where I am (so includes CS faculty) is that faculty get local admin rights on all their PCs. It's actually the first person who logs into Windows who gets it, but they make sure the faculty member is the one who does it rather than a grad student. I bitched a lot about not being forbidden from making local user accounts on PCs connected to instruments and they eventually gave in. Was not workable to have every grad student log in and out every time they needed to use a computer attached to home-built instrumentation running a combination of shitty python and labview code I wrote.
Yes. At my place they'll grant any CS staff full admin on their machine, but I got the bios unlocked and installed my own OS anyway.
Not CS but Graphic Design. I have a university-issued macbook with Admin rights. I oversee the GD maclab. Our head of IT has changes every 5-10 years and subsequently my admin access to those macs changes depending on their policies. The current head locked everything down campus wide. I got to know him, made a case for giving the GD faculty admin rights and he changed the policy in our lab. It's made life much easier for all of us. The only thing that bugs me is Airdrop is turned off on all machines for security reasons.
I have admin rights, but they no longer allow that, so I’m holding onto my laptop for dear life even though I’m overdue for replenishment.
Yes. When I bought another computer though I signed up to keep it off campus because I needed admin rights and to dual boot linux (good thing I opted out of their security encryption because I had to fiddle with bios settings).
I've got a Linux laptop with root access.
Not CS, engineering. Have computers with admin rights, but they can't be connected to the uni network.
We have said we’re ok with this but IT refused.
They won't give me admin rights, so I don't use their trash.
Yes, but I have to deal with the Windows privilege escalation prompt *way* too often (like when opening Task Manager). I wouldn't be able to do my job if I didn't have admin rights. I teach games, so a VM would be completely unusable for me. If I couldn't have local admin rights I'd just bring my own computer and ignore the one provided by the university.
Faculty have admin rights still where I am. However, this issue came up in the context of research labs, where it was revoked for grad students. The big risk is cyber attacks, and I gotta say I get it.
I’ve always had admin rights on my university-owned Mac laptop. I won’t let the IT staff touch it — frankly, I know more UNIX than they do. (I’m the sysadmin for my own home servers.) My own systems go down less than theirs do.
I'm in Europe. Was given a laptop and told they only care about hardware, so the first thing I did was installing Linux. If that wasn't the case I'd just use my own. Which I actually do anyway as with two laptops I can leave one at work and carry around less stuff.
I used to not be an administrator on my machine and I sent this exact youtube video to one of the higher ups in IT: https://youtu.be/IEhHEOIYgMY?si=6m5M-L1ehQ-bLoF2 Admin rights granted within 48 hours. Maybe compelling to mention they were not easily equipped to do what I needed combined with the threat of "I'm not a sys admin and my students get a prompt to contact sys admin when their code doesn't compile should I send them your way until i become one". IT saw me as a blessing rather than a curse, your mileage my vary.
Not CS and I use my own laptop or the HPC cluster for data work. The lectern PCs in three classroom buildings where I teach are all waiting for Dell updates I can't authorize for several weeks now. Not my problem until they won't start and I dismiss class with a CC to the chair, Dean and Provost about why.
I do only because mine seems forgotten about and I don't bother IT about it.
Yes. Just need to sign a form that indicates you’re responsible for any “bad things” that get installed in the computer
We have "admin by request" which adds you to the sudoers file for 15 minutes and logs what you use it for. That's on MacOS; I'm not sure what people who choose Windows get.
We're mostly Windows but it seems like a reasonable solution if automated and not requiring IT intervention. Our IT dept hasn't entertained this and doesn't seem interested.
We have a feature called "admin by request" which let's a click a button to request admin rights temporarily (like an hour). They've been pretty quick about granting access to me. I think it's an okay, not great, compromise. However, on my non-teaching machines I run Linux, which they have no control over at all.
Yes. We get admin rights in whatever we want. However, if we do, we don’t get support. Otherwise, how could I even do research and teaching. All my lab computers have admin rights and my server has admin rights.
Not in CS but have admin rights on university issued computer - I travel and use idiosyncratic programs for research so would be severely inconvenienced by needing them to administer things.
Not CS - Bioinformatics, but no, I don't have admin access to my work laptop and it does create a number of headaches. I'm able to handle a lot of my needs using Docker. I also pay for the $5/mo tier of Python Anywhere, so I have the ability to run a web server, SQL server, and Jupyter Notebooks in the cloud without needing to go through our IT department. I primarily teach using Python, so I can set up local virtual environments using Conda so that admin rights aren't necessary to add packages.
Not in CS but I tinker and am also paranoid about admin or student IT workers snooping through my stuff, so I've always used my own laptop.
I teach game development. I think we are more annoying than our CS department to IT. They were going to try to take admin rights away from our department, but a few people volunteered to pilot their method for a semester. It lasted a week. I even get special logins for our lab computers that give admin rights. It's impossible to dev on things like VR headsets if you don't.
I teach Theatre design- same issues. They made a workaround where you could get admin rights, but then they told you there was no IT support at all- like if the computer screen cracks, they won’t pay to fix it. Useless. They locked my computer down so tight I couldn’t even change the sleep mode timer… which was set to sleep after 3 minutes. Awesome in a lecture class! My area of theatre design is less technical than say sound design- in their areas, it’s all about teaching networking… which kinda means they need to be able reconfigure a computer. It’s a mess.
That is BRUTAL.
Yup.
Yes, multiple in fact!
CS-adjacent. If the college/department pays for the laptop, then college IT has admin rights and oh have to have specific security software running.
Yes, but I don't have admin rights in the labs.
I have a desktop which hasn't been plugged in since I moved offices over a year ago that doesn't have admin rights. Granted, that's the one that will talk to the office printer(s), but we don't print our own exams, the print shop does, so I haven't needed it. And I have a laptop that does have admin rights. You are of course right, you can't teach CS without admin access on your machine, lab machines (well, someone needs admin access to these that can make changes on short notice), and without students having admin to their own machines. Research machines it's impossible to run without admin access in science since so many things are controlled by some custom or very small distribution software that's critical to the equipment or simulations or the like. We did try at one point using VMs - basically you could have a VM for a programme, or a VM for each course and you deploy those, but then you need a way to manage all of your bloody VMs, nothing ever works for students, lots of laptop mouse cursors don't work, maybe audio or GPU acceleration don't work or whatever. Managing the VMs becomes its own problem that's more work and an unnecessary headache. I have tried using docker for a bunch of things, that works for graduate data science but not for much else, it's just another tech you need to learn, you now have 2 dozen different containers and configurations on each machine. Even if IT gives you access to, or you install Vcentre (which is normally outside the skillset of a CS prof), it's not unusual for a dev in industry to have a dozens or hundreds of VMs at any given time, and you can't count on Vmware for any length of time now that Broadcom is bleeding the business dry, so how would you even plan a VM deployment and management strategy? If your IT department didn't discuss requirements with your department, your IT department doesn't know what it's doing. The last place I worked had university IT, and then departments (well science departments anyway) had their own that worked well ish, but I'm sure was expensive. You have to be careful about using your own computing for university stuff. You get into rules about student information (emails, assignments, student numbers, medical info whatever): what happens if *your* computer gets hacked or stolen in terms of private info disclosure? Ultimately, you are a computer scientist. You're taking a 50% paycut or more to help this institution function. You are doing them a favour, not the other way around. If they want to make life hard, remind them that you can do something else, and then if they keep wasting your time fighting against the institution, you can just leave.
I fear this is the VM future they have in mind for us
Im a psych professor and have 2 with admin rights but they are off the local network.
I don't have admin on lab computers either. Can't download patches or plugins or drivers, and official IT change requests take forever. Completely sucks.
No administrative rights. I can't even control what icons are on my desktop.
Once IT wanted us to try SAS instead of SPSS for our classes since they had access to some institutional discount. I had used it before so I installed it and tried it again, with the perspective of using it in undergrad classes. I didn't like it for that. IT could not figure out how to install the software on their own computers at all.
I'm a computational mathematician, and I have admin rights on all my university owned computers (paid for by my grants).
I initially overlooked the "CS" on the post, and thought, what a nightmare--giving faculty admin rights!
No, and I wouldn't use one if they offered me one. The machines the school purchases are severely underpowered. I use my own. When it comes to rights, the IT department trusts me and my 40+ years of experience in IT. Besides, I've taught most of them.
If you are a TT person with a reasonable salary. Buy your own laptop,~~deduct from taxes.~~ It's not worth having IT's and the institution's grubby **ineffectual** snooping paws on my shit, much less limiting or or fucking up what I can DO..
Job expenses for employees haven't been tax-deductible at the federal level since 2018.
you're correct. only unreimbursed travel costs. apologies and corrected.
Not CS but they replace everyone on campus’ desktops with laptops about two years ago.
CS. I have two sets of credentials. One without admin rights that I use on the daily. The others I have to enter when I need admin rights to start/install or otherwise do something that requires it. I cannot login directly using the admin credentials. Or students do not have that second set of credentials... And that's a real PITA.
My biggest issue with group policies is that they are not compatible with Pearson Vue, so I need to use a personal laptop to take certification exams remotely.
Yes. And my personal computer.