I have company/domain setup with about 150 + users. I don't want to grant the users a local admin account to prevent them from installing programs that may used to attack - harm the network or other users. YET I have some users that sometimes they need to install some tools in order to accomplish their tasks.

Is there a tool or a way where I don't have to grant the users Administrative privileges yet allow them to install some Apps (predefined list) when ever they want without returning to helpdesk team or a system administrator.

Group Policy perhaps ?

My useres use Windows XP and Windows 7 both 64bit and 32bit

and for the servers - Windows server 2003.


You could do this via Publishing Software GPO.

If you're new to GPO, you can control who has access to use the software via the Security Filter, which you can create a security group to better manage who has what software.

Computer Configuration > Software Settings > Right-click Software installation > Click New > Package


  • 1
    +1 - Software publishing sounds exactly like what you're looking for. You're going to quickly become disillusioned, though, when you discover that the vast majority of applications aren't distributed as MSIs (and re-packaging programs as MSIs isn't a simple "click and go" procedure, no matter how many repackaging application vendors would try to convince you that's the case). – Evan Anderson Jul 31 '11 at 22:24

I would also added to Nixphoe's answer that if the software you are looking for isn't distributed as an MSI package you can use WinInstall LE to create your own MSIs. This way you can publish or even force an install on a group of computers that all require the same software package.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy