Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a network with windows server 2008, Active directory and Vista workstations. I need to allow users to install applications and fonts when they need to (don't worry they are all trustworthy folks :) but I do not want to make them domain administrators.

How can I do this with AD?

Many thanks

Richard

share|improve this question
    
Trustworthy != knowledgable enough to not install malware innocently... :-) –  Bart Silverstrim Aug 17 '09 at 14:48
    
See my updated answer. –  JS. Aug 17 '09 at 15:01
add comment

4 Answers

up vote 4 down vote accepted

You only need to make them Local Administrators (on their workstations) not Domain Administrators

For a script, see How Can I Add a Domain User to a Local Administrators Group?

strComputer = "PCName"
Set objGroup = GetObject("WinNT://" & strComputer & "/Administrators")
Set objUser = GetObject("WinNT://MyDomain/MyUser")
objGroup.Add(objUser.ADsPath)
share|improve this answer
    
Is there a quick way to do this through AD, I have tried adding the following startup script with no luck: net localgroup administrators "Domain\User Groupname" /add –  Richard Aug 17 '09 at 14:52
    
Then you have the advantage to now that they are local admins every time IE hits a webpage with an attack vector on it their machine will be compromised. It does not matter if trustworthy as windows is not. –  eriko Aug 17 '09 at 15:48
add comment

Add the AD account for the user to the local system's administrator (or power user, if possible) group.

I open the MMC (in XP with right clicking my computer and click on manage) then open the users and groups from the tree and from there in the groups add the domain user to the power user or admin group. They should be able to log in and add things as necessary from there.

As I alluded to in the comment, though, browse-by malware and such will also have admin access to that computer as that user is working.

share|improve this answer
    
The 'Power Users' local group in Vista has the same rights as the 'Users' Group. Its just there for backwards compatibility. –  JS. Aug 17 '09 at 14:56
add comment

Set up a second user on the local machine with local admin rights. Something like "username_la". When the user wants to install something use "run as" or enter the alternate credentials when they are asked to authenticate the install.

This reduces the exploitable surface area of windows.

share|improve this answer
add comment

Add them as local administrators using restricted groups in Active Directory/Group Policy.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.