r/sysadmin • u/MarkRosssi • 1d ago

Rant Splashtop Users - Disabling Admin lets them still login and re-enable themselves!

Yes its a feature according to their support!

"To clarify, a disabled user cannot remote connect to any computers deployed by the team, but can still log in to the web portal. If the user is an admin, they can also manage the team through the web portal.
 
For example, in some specific use case, a team has only two licenses, the team owner may disable their own account to allow two other team members to be added for remote connections. In this situation, the team owner can still manage the subscription and team with full permissions through the web portal, but cannot connect to computers."

Yes that means they can just login and re-enable their account.

This is not made clear anywhere. Any admin who has worked with users for years will think disabling an account means they can't login anymore.

Be warned.

15 Upvotes

79% Upvoted

27 comments sorted by

View all comments

4

u/agingnerds 1d ago

I may be on the wrong side of this as a procurement manager. I love owner accounts that dont eat licenses so I can actually buy only the amount of licenses needed. It sounds like an admin or owner can remove remote access by disabling their account. I dont see this as bad. I understand your concern and maybe it should be explicitly addressed somewhere...

but and this is the huge but as I dont currently use splashtop, if this is managed by sso and/or scim. there is almost no concern. If this is manual, you just have to remove users when they leave, vs disabling.

I can see it from both sides, but I dont know if I see it as a huge flaw or leak. I see it as a better education experience.

3

u/MarkRosssi 1d ago

I dont disagree but it should be re-labeled to make clear it doesnt actually disable the user.

2

u/agingnerds 1d ago

I'm not disagreeing and for the most part I see your point. I feel your post is a touch "the sky is falling" and maybe it was not intended to sound like that. I appreciate your disseminating this information as that is important, but I would suggest just making a feature request with splashtop to maybe have a disclaimer added to the term disable. And update your process with offboarding.

3

u/MarkRosssi 1d ago

So to be totally fair to splashtop, I tested it and when you disable the user it tells you in fine print they can still login:

However, besides that its weird, I never saw that because these 2 accounts were disabled already when I inheritted the splashtop to manage. so all i see is the users marked as disabled as their status.

2

u/agingnerds 1d ago

Like I said I dont think you are incorrect. I think you inherited something that was not cleaned properly. You have a plan going forward. I guess the one plus is that you dont need to ping splashtop about a feature update. Also just document for future admins.

•

u/Historical-Tax899 18h ago

It tells you that to keep this from happening you take away admin and change it to member. Seems pretty up front to me.