In many Swiss SMEs, the principle still applies: “The main thing is that it runs smoothly.” When employees need new software, want to update a tool or install a printer driver, they are often simply granted local administrator rights on their company notebook. This supposedly saves the IT department time and keeps operations flexible.

But what seems like an efficiency booster in daily life opens Pandora’s box from a security and compliance perspective. Local admin rights for users are today one of the biggest IT risks for SMEs – and a direct violation of modern security standards.

The legal framework: The Swiss Data Protection Act (nDSG)

Since 1 September 2023, the risk is no longer only technological but also a massive legal risk. With the revised Swiss Data Protection Act (nDSG), the obligations for Swiss companies have been drastically tightened.

According to Art. 8 nDSG (data security), companies must ensure, through appropriate technical and organisational measures (TOM), that personal data – for example customer data, HR data or plans with personal references – are protected against unauthorised access.

Anyone who grants their users blanket admin rights violates the data protection minimal principle (Principle of Least Privilege). If data leakage (Data Breach) occurs due to infected, self-installed software, the responsible natural person – often management or the IT manager – faces personal penalties and fines of up to CHF 250,000.– for intentional breach of duty of care.

The reality: local admin rights are not needed at all

The truth in modern IT operations is: local administrator rights are no longer needed at all nowadays. If the internal IT and software distribution are cleanly standardised, well thought out and professionally set up from the ground up, deployment runs fully automated in the background. The user opens their device in the morning and has exactly everything ready for productive work from the first minute.

As a modern IT service provider, we solve this balancing act between security and productivity through a smart combination of two market-leading systems:

• Secure governance via Microsoft Intune: We use Intune specifically to enforce global company policies and security settings on devices. All employees work daily with a standard user profile without administrative privileges. Malware thus has no chance to make deep system changes.
• Automated software distribution via RMM: We primarily control program deployment via our central RMM system (Remote Monitoring and Management). Through a huge, cross-customer software repository, we distribute standard applications such as CAD programs, Adobe tools or Office extensions completely automated in the background – without any access rights for the end user.
• Cross-customer patch management: Security vulnerabilities usually arise due to outdated software. Our RMM system proactively patches all installed applications in the background. When a vendor closes a security gap, the update is automatically rolled out without the user having to click anything.

Quality before speed: introducing new software with care

An often overlooked advantage of this central management is the gain in quality. New applications or deep system settings should never be rolled out thoughtlessly in live operation.

A professional IT approach means that new tools are tested thoroughly on test systems in advance. This prevents incompatibilities and system crashes. This structured approach ultimately saves companies a lot of time and support costs. At the same time, it gives employees a high level of clarity, security and professionalism in daily work.

Conclusion: A modern IT service provider (MSP) delivers the solution

Local admin rights are not a comfort feature, but an IT security risk, logistical chaos and a compliance violation against the nDSG. The example of our customer from the architecture industry shows: the supposedly “quick” working is long-term paid for with a lack of transparency, lengthy onboarding and data loss.

A good IT service provider or Managed Service Provider (MSP) must be able to offer you exactly this standardized solution: a protected environment orchestrated by Microsoft Intune and automatically supplied by a professional RMM tool. This way SMEs regain full control and comply with Swiss legal requirements – without frustration for the staff.