up vote 2 down vote favorite
1
share [g+] share [fb]

We have migrated a number of ordinary domain users from Windows XP to Windows 7 workstations. UAC is turned off.

Is there a way to allow these users to update their own applications (Adobe Flash & Reader, Java, etc.) on their workstations without being part of the local Administrator group? Some setting in Local Security Policy (secpol.msc) perhaps? In testing, adding one of these users to the local Power Users group did not help.

link|improve this question
whats wrong with just pushing the updates to them? – tony roth Mar 30 '11 at 4:24
@tony roth - There's nothing necessarily wrong with that... We have looked briefly into pushing updates, but we're really not Windows admins and the learning curve seems a bit steep. That's not to say we can't learn it, but also don't have a lot of time. It's a catch 22 - We don't have a lot of time to spend learning how to do that, but we also don't have a lot of time to update the workstations ourselves. Fortunately there are only about 15 workstations. – RelentlessMike Mar 30 '11 at 13:46
what domain schema level are you at? – tony roth Mar 30 '11 at 21:28
@tony roth - The Domain functional level and Forest functional level are both Windows Server 2003 interim. We jumped from NT4 domain controllers straight to Windows 2003 domain controllers a couple years ago. – RelentlessMike Mar 31 '11 at 5:08
feedback

2 Answers

up vote 1 down vote

Our Desktop Management team fought for months with this very issue and the end all result was to make users local administrators (not the best option, I am aware). However, from their findings, the best/only solution they could find was a nasty security and registry hack to give uses local admin type privileges to specific applications and their locations. The problem was that any time a user needed to update an application that wanted to touch a location the user didn't have their special "hack" rights to, the upgrade would fail and sometimes even corrupt the application.

link|improve this answer
feedback
up vote 0 down vote

We haven't actually bitten the bullet...I've been trying to work out a way to push the updates as required, but that's got so many issues...Too many different software vendors, so it's turning into a huge headache. It's starting to look like we're going to have to give them local admin. I'm not happy.

The first people to windows 7 are the last people I'd want to be able to install their own junk. It'll almost be less of a headache to wander by, log in, and update them myself.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.