(Yes, I know it’s supposed to sign them in automatically. It doesn’t always. We’ve got tickets in. What does work every time is signing into Office when prompted.)
(Yes, I know it’s supposed to sign them in automatically. It doesn’t always. We’ve got tickets in. What does work every time is signing into Office when prompted.)
A lot of heavy lifting going on in those words…
Also, the malware which gets bundled with “free” versions of products usually doesn’t care if the install fails or succeeds, just that the user downloaded the package, unzipped it, and double-clicked on the ever-so-helpful “install.lnk”. Most of the current ransomware and infostealer malware doesn’t need local admin to do it’s damage. Plenty of Remote Access Toolkits (RATs) will run quite happily in user space. Users can edit their local RUN registry key and/or create scheduled tasks. And there are doubtless Privilege Escalation vulnerabilities sprinkled around the system like fairy dust when it gets to be time to dump the SAM hive or lsass memory space.
Yes, locking down local admin gets you a lot, in terms of security. It’s far from a trump card though. Lots and lots of damage can happen in user land.