One shared administrator password for the whole IT team feels convenient for about a month. Then something is deployed at 2 AM and nobody knows by whom. Roles and least privilege fix that — permanently.
Endpoint Central can patch every PC, install software anywhere and view any screen in the company. Handing that power to a single shared login is the most common security mistake in small IT teams, and it is made on day one, casually, 'just to get started'. This page sets up access the way it should be: roles defined by job, one account per person, the minimum modules each job needs. It takes twenty minutes, and it converts your console from an anonymous superpower into an accountable tool.
A shared account destroys the audit trail. Every log line names a login, and when the login is everyone, the log names no one.
If this panel looks familiar, fix it today. Former staff who still know the admin password are a real risk, not a theoretical one.
Design the role once, assign people to it as they join, remove them as they leave. Permissions follow the chair, not the friendship.
Four roles cover most small teams. Start here and refine only when a real need appears.
The free edition of Endpoint Central supports one technician and up to 25 endpoints. That makes roles feel pointless at first — there is only one of you. Set the habits anyway: a strong unique password on the admin account, stored in a password manager, never shared in chat. The day the company upgrades or a second technician joins, you will extend a clean system instead of untangling a shared one.
Write down the jobs first. A patch operator needs the patch module, not remote control. A helpdesk technician needs remote control and inventory, not the power to push software company-wide. A manager who wants reports needs read-only report access and nothing else. Create each role with only those modules, then create user accounts inside them. Reversing the order — users first, permissions 'later' — means later never comes.
Every technician signs in as themselves. This is what makes the product’s audit history worth anything: deployments, configurations and remote sessions are recorded against an account, and the account is a person who can say 'yes, that was me, here is why'. The moment two people share a login, every investigation ends at a shrug.
Keep full administrators to one or two named people. Everyone else works in a limited role and asks for an elevation when a task genuinely needs it. This is not distrust — it is blast-radius control. A limited account that is tricked, stolen or simply mistaken can only damage the modules it holds; an admin account can damage everything, everywhere, at once.
Put a recurring reminder — quarterly is fine — to review the technician list. People change roles, leave the company, or finish the project they were hired for. Disable accounts that are done. The review takes ten minutes, and it is the control that keeps every other control on this page true over time.
Every setting on this page is shown live in the ManageEngine configuration video — watch it once and your own setup becomes easy.
▶️ Watch Full VideoThe free edition supports one technician and up to 25 endpoints. Even with a single technician, use a strong unique password kept in a password manager — never a shared or reused one.
Because an admin account can patch, deploy and remote-control every machine at once. Limiting each role to the modules its job needs means a stolen password or a mistake can only cause a small, contained problem instead of a company-wide one.
It becomes useless. Endpoint Central records actions against the signed-in account; when five people share one account, the records cannot say which person performed an action — which is exactly when you will need to know.