AD windows server 2003 user can install program, how is possible?

Question

Hello I am in a little factory and it is my first time there, they had a windows server 2003 and i wonder how they have set up the users in a unusual way.

The users can install any program and i don't understand how someone before of me did this.

This user (not administrator) is memebr of "users domain" that's it.

I did try to configure a new user same that but my new user cannot install any program, it require a administrator user to do that.

So, i can't understand, how is possible? In the AD server apparently the two users are the same, but, the first user can install everything the second not.

My question is: Someone can help me to find out HOW they set up the second user? Some one please can make me a list as a "step by step" to check?

Thanx in advance

----- UPDATE AUGUST 27 2010 -----

sorry for this later response, and also, i'm at home right now and i cannot check, but, i'll tray again to explain.

In Server 2003 AD DC: user is created as default, and it is not member of admin users.

In workstation: once has made a logon, user has privileges to install everything on THIS workstation, seems that has admin rights, but in server 2003 it is a normal user.

In this workstation, as client of a AD DC, there exist only the administrator user.

as jscott write, maybe point to a right direction.

maybe, if i do as follow:

1) on workstation change domain to a workgroup (example: domain is mydomain.com workgroup will be: mydomain)

2) on workstation log in as administrator 3) on workstation then i can check if exists a "domain users" group member of "administrator group" if this could be yes, that every AD normal users that use THAT single PC, will have administrator rights.

What i wrote has any sense? Could be work? I think that workstations that act in this way, could be have them this king of config.

I cannot check right now, someone can do this check on his/network?

I think that the right question will be:

Give Local Administration Rights to User Domain

Ho can i do it?

Answer 1

I am assuming that the server in question is not a domain controller.

Log onto the server in question as a domain administrator.
Click on Start, Right click on My Computer and choose manage.
Expand "Local Users and Groups"
Click Groups
On the right hand side, double click administrators.

EDIT: Yes it is a DC...
Log onto the server in question as a domain administrator.
Open Active Directory Users and Computers.
In the domain there should be an OU called "builtin".
In that OU there should be a group called Administrators.
Double click that group and check the members of it.

I'm sorry I can't be quite as step by step with this, my DC is server 2008 and I can't remember how similar they are.

Any one in this administrators group will have permission to install programs.

Answer 2

Are you sure that the application was actually installed (i.e. it is in the Add/Remove Programs), and not just a standalone or portable binary application?

-Waldo

Answer 3

Well... I have figured out.

I was too quick to install at home a windows2003 server and a windows xp on VirtualPC to make some tests.

On a workstations of AD. Log on as administrator, start->user controlpassword2

on local group, in administrators group, simply ADD:

DOMAIN\user name

or if we want just ALL Domain Users add:

DOMAIN\ Domain Users

Log off ad re login as user....

Sorry if my first question was badly explained Regards and thank you for your help