Contractors asking for admin access but not knowing basic IT
Unqualified contractors frequently request full administrative control over infrastructure while failing to understand basic IT tools like firewalls, virtualization, or web servers. This leaves companies vulnerable because these contractors do not know how their requested changes will impact production systems.
What the numbers show
Counted from the threads quoted below. How we count
- It goes quiet, then comes back — 3 separate clusters since February 2026.
- This comes up 115.5× more often in r/msp than across the site as a whole.
What people tried
Every workaround mentioned in the threads below. We haven’t tested any of them — and nobody here is claiming they worked.
Found another way around this?
Share your steps and trade-offs so fellow engineers don't have to reinvent the wheel. No account required.
- 1Writing formal warnings to business owners outlining security concerns and liabilityDid this help you?
- 2Provisioning isolated, sandboxed servers in a DMZ with restricted access to see if the contractor can actually deliverDid this help you?
- 3Demanding that contractors submit their technical requirements in writing before granting any permissionsDid this help you?
- 4Isolating vendor machines on a separate VLAN without internet accessDid this help you?
- 5Using SecureLink or screen-sharing tools like Zoom, Teams, or ScreenConnect while IT monitors the sessionDid this help you?
- 6Deploying a controlled jump box, service account with minimal privileges, or strict firewall rulesDid this help you?
- 7Removing the vendor's delegated admin access relationships entirely.Did this help you?
- 8Refusing to grant the requested access when initially setting up the vendor.Did this help you?
- 9Auditing and removing unnecessary enterprise applications and role delegations.Did this help you?
In their words
Unedited, grouped by where they were said, most upvoted first within each place, each linked to the thread it came from.
“He had never heard of Fortinet firewalls and wanted to know about switching it to a Cisco or other "more well known brand ". He was not familiar with virtualization or how it worked.”source ↗
“I asked him if he needed a Windows or Linux server and he did not know. I asked if he would need Nginx, Apache or IIS and he didn't know what any of those were.”source ↗
“In fact Pax8 themselves could never give us a clear answer to this question. Which is why we started not giving them GDAP access. So far we've seen no consequence.”source ↗
“They don't know what they want, how to do it, or the impact of it.”source ↗
“I've never given Pax8 the GDAP that they request, no desire to trust another vendor with that level of access to my clients.”source ↗
“When actioning support requests, they use their gdap privileges to poke around in the tenant or make changes. However the scope of access is far too great, a reader role should suffice and they can just relay the setting they need me to change...”source ↗
“Lately I have been getting a lot of pushback because we wont give them unfettered access to our network. We wont allow them to just remote into these systems.”source ↗
“We are getting more and more issues from them vendors acting like we are the strange ones.”source ↗
“I've had a vendor ask for a straight port forward for 3389, clear to the internet so they can "work from outside of the office", then demand DA access to the network.”source ↗
“The vendor always says 'we never have this problem with other customers'.”source ↗
Where this came up
People with this problem also raised
- 69Why are contractor and window replacement quotes so absurdly high?
- 2Why is it so hard to get contractor quotes?
- 111How to handle a bad contractor who won't fix poor work
- 6What to do when hired contractors stop communicating
- 3How to tell if unlicensed electrical work is dangerous
- 6Contractor installed a different size unit without asking