EXPERT RESPONSE
This is a common request/demand. Has your access control group given a good reason as to why they need such rights? If they can justify the business need, then I don't see why you couldn't reasonably create accounts for each user, enable logging, and let them do their thing. It sounds like the 'access control' group may have some justification for this anyway.
So, you need to determine what access is really needed, why it's needed, when it's needed, and so on. You do have a documented access policy that covers this, right? If not, now's the time to create one based on risks and business need. A change management policy and procedures need to be in place as well to make sure everyone is on the same page regarding making system changes. Once these are established, then use Windows audit logging and the right tools from vendors such as Ecora and Configuresoft to make sure they're not abusing their rights and everything's being doing properly.
|
