University Computer Administrator Access Standard Procedures

When to Use?

Use this procedure to grant, manage, and remove administrative privileges on university-owned or university-managed systems at Grand Valley State University (GVSU). It applies to anyone granted administrative or other elevated privileges

Before you submit a request, make sure you:

1. Have a documented business or operational need that a standard user account cannot meet.
2. Know the name or asset tag of every machine you need access to.
3. Have read the Computing Conditions of Use (SLT 11.5).

Rules for Appropriate Use

These rules apply to everyone with administrative privileges:

• One owner per account: Each administrative account is assigned to one person, who is solely responsible for all activity performed with it, as stated in the Computing Conditions of Use.
• Do not share credentials: Only the authorized account holder may use administrative credentials. 
• Use multifactor authentication (MFA). Administrative access must use MFA
• Use privileges only when needed. Use administrative privileges only for authorized administrative functions. Do routine tasks such as email and web browsing with standard user access whenever technically feasible.
• Do not create unauthorized administrator accounts on any machine.
• Do not interfere with IT support or security controls. Do not remove or modify accounts set up for university IT support. Do not disable, remove, bypass, or otherwise interfere with university-managed security controls without our prior authorization, even temporarily. These controls include endpoint protection, security monitoring, logging, configuration management, and vulnerability management tools.
• License all software. Software on university-owned or university-managed systems must comply with applicable licensing requirements and university software policies.
• Follow the law and university policy, with particular attention to copyright. All actions on university systems are subject to university IT policies and standards, including the Computer Virus and Malware Policy (SLT 11.3).

Procedure

Request Administrative Access for Windows

GVSU Windows devices start with a standard account. You can ask for temporary admin access. It lasts 24 hours. 

1. Sign in to the GVSU IT Services portal with your GVSU credentials.
2. Open the administrative access request.
3. Enter your contact information and the operating system of each machine.
4. Give a business or operational justification. Describe the specific task, application, or project that needs elevated access.
5. Submit the ticket. 
6. We notify you of the decision in the ticket via email. 
7. Once you have been approved, restart your computer for elevated access.
8. After 24 hours, you will get a message that your account is back to standard access. You do not need to do anything.

Request Administrative Access for macOS

GVSU Macs start with a standard account. You can ask for temporary admin access. It lasts 24 hours. It does not work on lab stations. 

1. Open the macOS Admin Access Request form in the GVSU Service Portal. You can also open it from the Support app. Look for it at the top right of your Mac's menu bar.
2. Fill out the form. Write a short reason why you need admin access.
3. Submit the form.
4. Wait a few minutes. You will get an email that lists the Macs assigned to you.
5. Click the link in the email. The GVSU Software app opens.
6. Click Run on the Administrator Escalation action.
7. Wait for the message that says admin access was granted.
8. Do only the task you need to do.
9. After 24 hours, you will get a message that your account is back to standard access. You do not need to do anything.

Do not turn off or change the security settings that IT manages on your Mac. These include endpoint protection, FileVault, the firewall, and the device management profile.

Report a Suspected Compromise

Report right away if you suspect your administrative credentials or elevated access were compromised, used without authorization, or involved in another security incident. Tell your supervisor as well.

1. Stop using the affected account or machine if it is safe to do so.
2. Open the Report Security Issue request in the IT Services portal. Say whether sensitive information may be at risk.
3. For suspected malware, a missing or stolen GVSU-owned device, or a BitLocker event, use the matching request on the Security Incident Response & Investigation page.
4. To report a phishing email, forward it to phishing@gvsu.edu.
5. Give us the machine, when you noticed the problem, and what you saw. Then follow our instructions.

Definitions

• Administrative privileges (administrative access): Access that provides elevated privileges to modify operating system configurations, install or remove software, manage user accounts, change security settings, or perform other functions beyond those available to standard users.
• Machine / system: Any university-owned or university-managed computing system, including endpoints (desktops and laptops) and servers.
• Standard user access: The default level of access that does not allow changes affecting other users or the security of the system.
• Multifactor authentication (MFA): A sign-in method that requires two or more forms of verification.

References and Public GVSU Resources

• SLT 11.5, Computing Conditions of Use
• SLT 11.3, Computer Virus and Malware Policy
• GVSU IT Services portal
• Report Security Issue
• Report phishing: phishing@gvsu.edu