A customer reported that regular users on their Windows systems can connect to the internet and download files, but accounts with local administrator privileges cannot. The software involved uses an Inno Setup thin installer that downloads the application content and then installs it with elevated privileges.
At first, this policy seemed unusual. An administrator could potentially use another account or otherwise work around the restriction, so I'm wondering how effective this control really is and what security goals it addresses. Is blocking general internet access for administrator accounts considered normal enterprise practice?
The immediate workaround was to provide the customer with a complete offline installer instead.
4 Answers
A download-and-install stub is a poor fit for locked-down enterprise environments. Organizations may need to archive installation media, support automated deployment, work in restricted or air-gapped networks, or install software without allowing the elevated account to access the internet. A full offline installer, MSI, or package suitable for deployment tools is usually the better option.
We use a similar model: privileged accounts have access only to the services they need, while software is installed through offline packages or centrally managed deployment tools. It can feel inconvenient for one-off installations, but it prevents installers from silently fetching unverified content under administrator rights and makes deployments more repeatable.
Yes, this is a common and sensible control. Privileged accounts generally shouldn’t be used for browsing or downloading from the general internet. Restricting them reduces the chance that a malicious download or drive-by attack gets executed with administrative rights. It may also be required by certain security and compliance frameworks.
That makes sense, especially when you consider the damage an accidental download could cause with elevated privileges.
The goal isn’t to make bypassing impossible; it’s to reduce exposure and keep the blast radius smaller. In many environments, local admin accounts are restricted through policy, DNS filtering, or firewall rules so they can reach internal services and approved cloud endpoints but not the wider internet. Administrators are also expected to use separate accounts for normal work and privileged tasks, with activity logged and audited.
It also discourages people from doing everyday browsing while logged in with an account that has more privileges than they need.
We provide an offline installer as well, and the downloader can be run without elevation before launching the actual installation. That ended up solving this customer’s issue.