GPO Allowing Domain-User to Install Softwares on Local Machines Without Being Administrator

active-directorygroup-policy

I have a specific OU with several machines in it.
I just created a domain-user who is meant to have normal standard-rights like an absolutely normal local-user on all the machines – the only thing he needs to be able to do, is installing any kind of software he wants, but without being either a domain or a local Administrator at the same time.

I thought maybe I could realize this, using a GPO for that user but I haven't come very far yet.

Is there a way to give the newly created user the permission of installing things on machines being located in that specific OU, without giving him all the other administrator-rights?

Best Answer

No, the problem you have is that to install a program the installer usually needs to write to C:\Program Files, C:\Program Files (x86), and C:\Windows. All of those directories are protected by the Operating System and can only be written to by an administrator. Additionally, if you make a change for all users on the computer (e.g. installing a program) usually the installer will write to HKEY_LOCAL_MACHINE in the registry. The HKEY_LOCAL_MACHINE registry hive is also protected by the Operating System and requires administrative access to write to.

Your other option is to push the software through Group Policy. That would allow to you to install the software on computers in the OU without users having administrative access. To do you will need MSI installation packages for each program you want to install.

Related Solutions

Local Admin user via GPO

My first recommendation is that you wrestle those admin rights away from users. It'll make your life so much easier in the end. SO MUCH EASIER! Users have a tendancy to really mess up their computers when they're admins...Viruses, spyware, toolbars, junky freeware, change this settings, delete this file...just don't deal with it.

That being said, if you really have to give users admin rights, you can easily create a domain user which has local admin rights on each PC. Start by creating a user in AD. Then create a group policy and apply it to all workstations. In this group policy drill down to this:

Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Restricted Groups

Add a new restricted group and make sure Domain Admins and the user you just created are members of it. This will not allow you to add any other local admin to these machines but will simply accomplish what you desire to do.

Can the users can apply Windows update without local administrator rights

Computer -> Administrative Templates -> Windows Components -> Windows Update
Allow non-administrators to receive update notifications

This group policy setting controls whether users need admin rights to install updates. If you lack GPO control over the systems, then use the equivalent registry hack:

HKLM\Software\Policies\Microsoft\Windows\Windowsupdate
ElevateNonAdmins
DWORD, set it to 1

Note that this setting only works up through Vista; in 7 it has no effect and admin rights are required for update installation.

Best Answer

Related Solutions

Local Admin user via GPO

Can the users can apply Windows update without local administrator rights

Related Topic