A good admin is not the one who connects everything. It is the one who knows which connections should be smaller, supervised, or refused — and can explain why in one sentence each.
This series teaches how to open the whole office network to a home PC safely. This final page teaches the equally important skill: when not to. Entire-network access is the maximum setting, and maximum is not always right. Sometimes the correct answer is a tunnel that reaches one PC, a session the office watches, an office laptop instead of a home PC — or a clear no. Each case below names the situation, the risk that changes the answer, and the alternative that still gets the work done.
If the person only ever does accounts entry, they need the accounts PC — not the server, the CCTV and the director's share. Use the VPN's access rules to limit that account to the specific addresses it needs. Least access is not distrust; it is damage control priced in advance. Most offices discover, when they think task by task, that only the IT admin genuinely needs the full network. Everyone else needed a door to one room and was given the building.
An outside technician, software support engineer or auditor's assistant should never receive a standing personal account on the office network. The pattern is: a named temporary account created for the job, enabled when the session starts, watched or at least logged, and disabled the moment the job ends. Better still for one-off work: they connect while a staff member sits with the session. Vendors who resist this are telling you something about their own security culture — believe them.
Some data is not the office's to risk on its own judgement. Client contracts in IT services, export or legal work, health and finance records, and government-linked projects often carry written conditions about where data may be accessed from and on what devices. If such a contract covers your office, the answer to home access for that data is written in the contract, not decided in the IT room. Read it first; where it demands office-owned devices or office premises, issue a company laptop or decline. 'The VPN is encrypted' is not a reply to a contractual clause.
The hygiene page in this series lists the disqualifiers: unpatched Windows, silenced antivirus, cracked software. When a machine fails, the refusal should be of the machine, not the person — the standard remedy is a basic office laptop configured by the office, used only for work. This converts an argument about trust into a purchasing line item, and it is why regular home working usually ends with company laptops even in small offices. Until the laptop arrives, the answer is genuinely no — a tunnel to a dirty machine endangers every other user of the network.
The most dangerous requests arrive dressed as urgency: a deadline tonight, an auditor tomorrow, 'just open the RDP port for this week'. Urgency is exactly when mistakes become breaches, and 'temporary' exposures are famous for being discovered by scanners long after everyone forgot them. The safe alternatives are all fast: the mesh VPN setup in this series takes under an hour, an office laptop can be couriered, a staff member can sit in the office for the deadline shift. There is no work emergency whose honest solution is an open port or a shared admin login.
Watch the video for the full-access setup — and use this page to decide who should get it.
▶️ Watch Full VideoYes — on office-owned laptops. The restriction is about the device, not the location. A company laptop with encryption, updates managed by the office and the same VPN account rules usually satisfies such clauses, and the contract point should be confirmed with the client in writing once, not debated per employee.
A named account that stays disabled and is enabled only during agreed support windows, with logs reviewed afterwards. If their work truly needs standing access, put it in the support contract with the same conditions you would give an employee — named users, MFA, and removal when the contract ends. Permanent anonymous access is not a support requirement; it is a habit.
No — it is the same reasoning as office keys. Most staff have a key to their room, not to the server room, the accounts cupboard and the director's office. Limited access protects the staff member as much as the office: if something goes wrong on a part of the network they could never reach, they are automatically above suspicion.