Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How do you add a user with installation privileges on Window XP?

She is connected to Active Directory on Win 2003 server.

Is there a global policy that controls her account to not allow her to install programs?

share|improve this question
Please don't ask duplicate questions, if you wnat to add more detail or get extra information, please add it to your origional question – Sam Oct 14 '09 at 13:09
up vote 0 down vote accepted

Check her local rights on the PC. If she has admin rights, you can easily take them away. It is pretty simple to do it remotely too. Just go to her computer account in active directory, right click on it and go to manage. There you can check her local account.

share|improve this answer
How about globally? Are there any right in Active directory? – user8077 Oct 14 '09 at 16:18

The only global (Domain-level) permission that can give this is Administrators, and you don't want to make a user a member of that group just so they can install programs. You might be able to hack something using User Rights Assignment in a GPO, but these rights are not intended for this kind of thing, and there will most likely be unintended consequences (besides which, it's cleaner and easier all round to use the built-in groups where possible).

If it's one user on one PC only you're talking about, you can just make them a member of the Power Users or Administrators group on that PC (connect via Computer Management). If what you're planning on doing is delegating the right to install programs on any PC to a specific individual, what you want to do is create a script that connects to each PC and modifies the relevant local group membership. Google for details. To start you off, it would look something like:

Set objLocalGroup = GetObject ("WinNT://computername/Administrators,group")
objLocalGroup.Add ("domainname\Software Installers")

Assign the permissions to a group rather than to a user here. You never know when the person may leave, or when you may be required to delegate this to more people.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.