Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I upgraded some machines to XP SP3, and now whenever the user tries to install anything they get a "You must be an administrator" dialog box; however I went in locally and added the user as part of the Administrator's group to the local computer's Users and Groups (i.e. Admin Tools -> Computer Management -> Local Users and Groups). The user has standard rights on the domain but nothing that would block this; users on SP2 don't have this problem and can install software.

How do I go about fixing this? It's getting annoying for the users to have to call me over and then have to log out, then log back in as the local Administrator account in order to install anything or configure an IP printer (option is grayed out except with Administrator account).

share|improve this question
    
Copy WHOAMI.EXE from a Windows Server 2003 machine down to one of the XP machines. Logon as the user who is supposed to be an 'Administrator' and run WHOAMI /ALL. Do you see the 'Administrators' group listed as one of the groups they are a member of? It sounds to me like the user isn't actually getting 'Administrators' group membership for some reason (Restricted Groups policy?). –  Evan Anderson Jun 3 '09 at 13:58
    
This seems workstation-suppport-like, but I'm pretty sure there are some GPO/domain settings that can cause this. Should be some interesting responses. –  Kara Marfia Jun 3 '09 at 14:03
    
Instead of "coming over" when an unprivileged user needs to run something as an administrator, why not launch the privileged task on the remote machine with psexec from your console? Doesn't hurt to open a Remote Assistance session first so you can see what the user is doing. (This is also very helpful if you need to open, e.g., a privileged command prompt when giving remote assistance to an unprivileged user.) –  Skyhawk Apr 15 '10 at 16:48

4 Answers 4

Two quick things I can think:

1) If you have a "Restricted Users" GPO set up in your domain, they may be getting removed from the Administrators group everytime there is a gpupdate (~ every 15mins)

2) Have you tried right-clicking (or SHIFT right-clicking) on the install file and choosing "Run as Administrator..."?

share|improve this answer

IMO letting all users run as admin on their local machines is a pretty bad idea, if you are only doing it to make installation of software easier please heed the above comment about right-clicking and running the installation as admin with your own credentials.

share|improve this answer

Use the following VBS to see if they are actually in the Admins Group:

Dim objComp
strComputer = 'Computer Name here
Set objComp = GetObject("WinNT://" & strComputer) 'seems to have issues here.
objComp.GetInfo  'or here....
If objComp.PropertyCount > 0 Then
    Set objGroup = GetObject("WinNT://" & strComputer & "/Administrators,group")
    If objGroup.PropertyCount > 0 Then
        WScript.Echo  "The members of the local Administrators group on " & strComputer & " are:"
        For Each mem In objGroup.Members
            WScript.echo vbTab & Right(mem.adsPath,Len(mem.adsPath) - 8)
        Next
    Else
        WScript.echo "** Connecting to the local Administrators group on " & strComputer & " failed."
        WScript.Quit 1
    End If
Else
    WScript.Echo  "** Connecting to " & strComputer & " failed."
    WScript.Quit 1
End If
share|improve this answer

You said the user has standard rights on the domain, which suggests a domain account, but you mentioned that the modifications you made were to a local user in "Local Users and Groups". These are two separate concepts.

First, is the user logging on as a local user or domain user? When they log on, is domain set to "Computer name (this computer)", or "Domain name".

If it is a domain account, what you want to do is open Control Panel > User Accounts. - Click Add - Type the username and domain - Choose "other" and set it to Administrators.

This gives that domain user administrative rights to that specific computer.

share|improve this answer
    
-1: Although they are seperate concepts, he appears to grasp them. His procedure is perfectly valid for giving a domain user local admin rights. –  pipTheGeek Jun 5 '09 at 18:00
    
You are correct, I mis-read the question as "gave local user admin rights". Whoops. –  Jeff Miles Jun 5 '09 at 18:32

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.