GPO Allow branch administrator to Install any application softwares such as .EXE Or .msi on his own OU client computers

Question

I would like to grant permissions to remote branch administrator to Install any application softwares such as .EXE Or .msi on his own OU client computers. This is the customer requirements.

The customer requirement is not to add branch administrator to Local Administrator group and also for Domain admin group.

I tried by granting below permissions, but its not working and not allowing to install applications such as Microsoft Office or PDF.

Computer Configuration->Administrative templates->windows components->windows installer:

1. allways install with elevated privileges -> Enabled
2. Enable user to use media source while elevated -> Enabled

Please Help.

Answer 1

For these remote branch admins to install whatever they want they will have to be local admins; no way around it.

But, if you aren't going to add them to the local admin group then ABOUT your only option is to use Group Policy to allow users to install a set of pre-approved software that is published.

This link will help you with allowing users to install the pre-approved software that is published, and this link is a supporting guide.

Let me know if you need more info.

Someone else may have another option they've used but my experience has led me to what I suggested being the best option short of local admin privs.

If anything changes and you get the ok for local admin privs, you can use a GPO applied to that branch OU that puts that user or group into the local administrators group on those OU workstations. See here for info on that GPO: http://www.petenetlive.com/KB/Article/0000589.htm -- be sure and follow that correctly though, or you might end up replacing instead of adding to the local admins group.

Answer 2

Another alternative is setting up a branch *account for this particular task/set of tasks that they can use. Technically not adding them as a local admin but giving them the capability as necessary.