Local Admin and Policies

Question

I have company/domain setup with about 150 + users. I don't want to grant the users a local admin account to prevent them from installing programs that may used to attack - harm the network or other users. YET I have some users that sometimes they need to install some tools in order to accomplish their tasks.

Is there a tool or a way where I don't have to grant the users Administrative privileges yet allow them to install some Apps (predefined list) when ever they want without returning to helpdesk team or a system administrator.

Group Policy perhaps ?

My useres use Windows XP and Windows 7 both 64bit and 32bit

and for the servers - Windows server 2003.

Answer 1

You could do this via Publishing Software GPO.

If you're new to GPO, you can control who has access to use the software via the Security Filter, which you can create a security group to better manage who has what software.

Computer Configuration > Software Settings > Right-click Software installation > Click New > Package

http://support.microsoft.com/kb/816102

Answer 2

I would also added to Nixphoe's answer that if the software you are looking for isn't distributed as an MSI package you can use WinInstall LE to create your own MSIs. This way you can publish or even force an install on a group of computers that all require the same software package.