Would you consider AMP endpoint protection negates the need to remove Administrator access

[ccwdeakineduau]

We are rolling out AMP for endpoints, and a lively internal discussion is whether we shoudl rely on AMP's malware protection so that we can provide our end-users with Administrator access. I'd be interested in people's thoughts.

[Marvin Rhoads · Accepted solution]

I wouldn't do it. A good security strategy uses defense in depth and multiple layers of protection.

If the end user has Administrator access then they also have the ability to stop the AMP for Endpoints service.

Also, not giving Administrator access to end users helps control what apps of all kind get installed - not just malware.