Security for remote users

[bwhitch]

Hi and thanks in advance for the replies.

The company I work for is primarily cloud based, we have a couple small remote offices.
We are not in a domain and don't have servers. We are using a combo of Salesforce.com and Google Apps. The issue I am running into is most of our users need to be local admins to be able to run a single piece of software (among installing and uninstalling various software). Company policy states that the company laptops need to be password protected, however I have come across multiple laptops that the user has removed the password and are storing documents and company data locally. This poses a serious security threat if a machine is ever stolen or if a user decides to get back at the company, does anyone have any thoughts on securing this type of environment??

Thanks

 

[RandyChrist]

SSL Security is recommended.

 

[root]

If you're worried about data security then you should be applying some kind of disk encryption. bit locker (the windows one) should be fine. just be sure to make sure that you keep copies of the encryption keys in case anything goes wrong with the hardware so that you can recover data.

as for people randomly removing passwords etc.

pick the person you like least and have them fired for serious breach of company policies. then you'll find that most people will put the passwords back on...

alternatively, keep the administrator account for your own use.
then set people up on the machine as users with their own logins etc, use the local policy editor to set restrictions on the password (e.g. password must exist and must meet complexity requirements.

Then make those users power users, so that they should have rights to do most things.

if you could stand the pain of doing it, I'd really recommend a domain though, it'll give you much greater control, and really you only need (in the smallest of small set-ups) and old PC running the server software then you can do things like upgrade all the software automatically, set encryption on all machines at once, set password policies etc...