1

I have a network with windows server 2008, Active directory and Vista workstations. I need to allow users to install applications and fonts when they need to (don't worry they are all trustworthy folks :) but I do not want to make them domain administrators.

How can I do this with AD?

Many thanks

Richard

Improve this question
2
  • Trustworthy != knowledgable enough to not install malware innocently... :-)
    – Bart Silverstrim
    Aug 17, 2009 at 14:48
  • See my updated answer.
    – JS.
    Aug 17, 2009 at 15:01

4 Answers 4

Reset to default
4

You only need to make them Local Administrators (on their workstations) not Domain Administrators

For a script, see How Can I Add a Domain User to a Local Administrators Group?

strComputer = "PCName"
Set objGroup = GetObject("WinNT://" & strComputer & "/Administrators")
Set objUser = GetObject("WinNT://MyDomain/MyUser")
objGroup.Add(objUser.ADsPath)
Improve this answer
2
  • Is there a quick way to do this through AD, I have tried adding the following startup script with no luck: net localgroup administrators "Domain\User Groupname" /add
    – Richard
    Aug 17, 2009 at 14:52
  • Then you have the advantage to now that they are local admins every time IE hits a webpage with an attack vector on it their machine will be compromised. It does not matter if trustworthy as windows is not.
    – eriko
    Aug 17, 2009 at 15:48
1

Set up a second user on the local machine with local admin rights. Something like "username_la". When the user wants to install something use "run as" or enter the alternate credentials when they are asked to authenticate the install.

This reduces the exploitable surface area of windows.

Improve this answer
1

Add them as local administrators using restricted groups in Active Directory/Group Policy.

Improve this answer
0

Add the AD account for the user to the local system's administrator (or power user, if possible) group.

I open the MMC (in XP with right clicking my computer and click on manage) then open the users and groups from the tree and from there in the groups add the domain user to the power user or admin group. They should be able to log in and add things as necessary from there.

As I alluded to in the comment, though, browse-by malware and such will also have admin access to that computer as that user is working.

Improve this answer
1
  • The 'Power Users' local group in Vista has the same rights as the 'Users' Group. Its just there for backwards compatibility.
    – JS.
    Aug 17, 2009 at 14:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .