Multiple Windows users on one Machine

[s.proch]

Hello all!

This might be a very thick question, but... Can multiple Windows users on one machine use an Autodesk product when they both have their own seat in the AEC license? I am asking because a colleague needed to use AutoCAD/Civil 3D on my PC in the office but was met with a bunch of errors regarding File Read Only/Full access permissions.

Is this because, once installed, only the Windows user who installed it on their account can use the product or is this due to our security settings on the company PCs? Has this got anything to do with the type of license we have? I could have sworn that this was possible before.

[TravisNave · Accepted solution]

Each user is licensed with their login, so that is not the problem.  It's likely some kind of security restriction on the machine and/or domain account.  Make sure that the end user has local admin rights (or at the very least, Power User privileges) on the machine.   There's a major misconception from naive IT folks that having local admin rights is somehow a bad thing and provides the end user with additional security privileges.  It does not. Local admin rights has nothing to do with domain rights and IT that restricts it are completely incompetent.  I can say this unequivocally because I have been an IT administrator for over 25 years.  

I suspect if you install and launch the software with local admin rights, your problems will disappear.  If not, post back here.  

[Simon_Weel]

Based on the first screenshot, AutoCAD tries to load / save the .cfg file in the Program folder. Apparently, AutoCAD is using the wrong configuration since this file should reside in the users Windows Roaming Profile. What you could do is check for files / registry key and remove them if they exist. Then run AutoCAD again. It then should copy the nesesary files to the users profile / set registry keys.

These lines remove files / registry entries for AutoCAD 2021. Modify them for your version. Open a command window and execute:

reg delete "hkcu\Software\Autodesk\AutoCAD\R24.0" /f
rd /s /q "%appdata%\Autodesk\AutoCAD 2021"

[Simon_Weel]

There's a major misconception from naive IT folks that having local admin rights is somehow a bad thing and provides the end user with additional security privileges

That's a bit steep? Having local admin permissions is like begging for malware to install locally and then roam the network.

None of 'my' users have ever had the need for local admin permissions....

[s.proch]

I think you are right. After 'running' back and forth between the team and our IT I had briefly had local admin rights to try to reinstall the software and the problem was gone until I got back my standard 'you can't do anything' rights. We tried setting up a new security group for the CAD team with full access to the Program Files and App Data Autodesk folders this morning and after resetting C3D to defaults on the second user, it seems to be working fine. For some reason, the IT team doesn't want any of us to be local admins. This is frustrating as you need to install or update software on an almost daily/weekly basis but you simply can't. It's like back in elementary school ICT lessons.

[s.proch]

Are the risks high? We have email security managers, threat lockers constantly scanning all our activities and never need to download anything that isn't from a verified developer (i.e.. Autodesk, etc.). Would local admins be really that bad? It's not like we browse dodgy websites in the office or receive suspicious emails due to the above security measures.

[Simon_Weel]

Are the risks high?

According to this article - yes.

But there are probably just as many articles stating the opposite...

[s.proch]

Interesting read. I am wondering what kind of endpoint privilege manager our IT use, if any. What sort of work do 'your' users do, if you don't mind me asking? I would assume then their machines were well maintained, software always up to date etc.? How often would 'your' users need to write a ticket or need you to fix something remotely? Because, in our case, this is almost on a daily basis. 

[TravisNave]

It's amusing to read articles like that, but in practice all it does is create more unnecessary work for the IT staff as well as more troubles for the end-user.  

100% of my users nationwide have local admin rights on their machines and the large majority WFH.  I control their updates via a WSUS server, so that is not an issue.  Their machines are backed up by 2 different solutions.  And because of this, I rarely have any day-to-day problems with my end users.  And any instances of technical support I do have never has anything to do with needing permissions to install or configure something.  

There are power hungry IT folks that just want to handcuff everyone to feel important.  I don't know if they think it is job security or what?  But when I work with customers and vendors, it seems like most of their problems stem from unnecessarily restricted IT policies.  If you are not government, educational, or medical, then I don't see any reason to have a restrictive enterprise.

[Simon_Weel]

---

@s.proch wrote:

Interesting read. I am wondering what kind of endpoint privilege manager our IT use, if any. What sort of work do 'your' users do, if you don't mind me asking? I would assume then their machines were well maintained, software always up to date etc.? How often would 'your' users need to write a ticket or need you to fix something remotely? Because, in our case, this is almost on a daily basis. 

---

We're a small company - about 20 employees. Most of them use Revit and AutoCAD. Occasionally NavisWorks and ReCap. For the office-related stuff they use MS Office.

Windows maintenance is mostly done using GPO's and GFI LanGuard for most other programs. Autodesk updates are a bit of a pain - I use the domain Shutdown script to install them.

As for fixing things - on average I get a single question of a colleague a day. And that's most of the times like 'How do I do xyz?'. Hardly ever security related questions. Like I said - there's no need for domain users to have local admin permissions. At least not in 'my' network.

[pendean]

---

@Simon_Weel wrote: ....there's no need for domain users to have local admin permissions. At least not in 'my' network.

---

What they don't tell you is probably more "telling" in itself, we all see it in these forums all the time. Being an owner/manager is tough, training and trusting is even tougher. 

[Simon_Weel]

What they don't tell you is probably more "telling" in itself

Since we have a flat organisation, my colleagues surely don't hesitate to tell me if there's a problem? And I'm too long in this business to act like the BOFH. Besides, I'm both system admin and user of all the stuff my colleagues use. And my user account is the same as all my colleagues as well. So if there's a problem, I'm most likely the first to notice.

The things in these forums occur mostly in hierarchical organisations, with a dedicated IT staff. They don't know all ins and outs of the software they manage. And if you can't directly interact with them in case of a problem, then yes, you most likely wish for admin permissions to solve the problem.

Back to the problem at hand - no, you don't need local admin permission to run Autodesk software. Now I don't use all Autodesk software there is, so I don't know if this statement is valid for all titles, but it is for the stuff we use. If there IS a need for admin permissions, then the program is most likely incorrectly installed.

[s.proch · Accepted solution]

There you go. Your colleagues don't need local admin rights because there is an admin doing the same work as them sitting in the same room. 

And to answer my question - Users do need full access to certain folders on the C: drive. Here are two links explaining what users need, and it is all to do with user permissions.

https://www.autodesk.com/support/technical/article/caas/sfdcarticles/sfdcarticles/AutoCAD-Family-Con...

https://www.autodesk.com/support/technical/article/caas/sfdcarticles/sfdcarticles/What-user-permissi...

@TravisNave , @Simon_Weel , @pendean Thank you all for your input!

[TravisNave]

Glad you're all set.  Not providing end users with proper local rights violates my first rule:  Never do anything that makes more work for yourself.