Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a small domain which contains several domain users. How can I set users to have administrator permissions ( for installing software) but limit them to accessing mass storage devices and dvd-rom? Also, I want to set limitations on accessing user and group management within Windows. I add their domain user to the administrators group on the local machines they can add new local users, which I want to block.

share|improve this question
Sooo if I understand correctly, you want to know what group policy to apply so these users can install software? But ONLY from USB and CD/DVD? – ST8Z6FR57ABE6A8RE9UF Jun 30 '11 at 21:28
up vote 10 down vote accepted

It's a bit hard to make out what you're asking, but you can't have it both ways. You can't have them as admins on the box, and yet still limit their access to other stuff. It's one or the other....

As a matter of caution, I would advise against having users as local admins on their workstations. Bad Things usually happen; usually involving you having to re-image the workstation because they installed some malware or another.

If you're in a domain, I can't rightly fathom why your users would need to add other users to the local machine. You do that kind of thing from ADUC, not the local machine. And if it's a small enough workplace, installing software that they need isn't too big of a deal. I would prefer that over the alternative myself.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.