I have a network with windows server 2008, Active directory and Vista workstations. I need to allow users to install applications and fonts when they need to (don't worry they are all trustworthy folks :) but I do not want to make them domain administrators.

How can I do this with AD?

Many thanks


  • Trustworthy != knowledgable enough to not install malware innocently... :-) – Bart Silverstrim Aug 17 '09 at 14:48
  • See my updated answer. – JS. Aug 17 '09 at 15:01

You only need to make them Local Administrators (on their workstations) not Domain Administrators

For a script, see How Can I Add a Domain User to a Local Administrators Group?

strComputer = "PCName"
Set objGroup = GetObject("WinNT://" & strComputer & "/Administrators")
Set objUser = GetObject("WinNT://MyDomain/MyUser")
  • Is there a quick way to do this through AD, I have tried adding the following startup script with no luck: net localgroup administrators "Domain\User Groupname" /add – Richard Aug 17 '09 at 14:52
  • Then you have the advantage to now that they are local admins every time IE hits a webpage with an attack vector on it their machine will be compromised. It does not matter if trustworthy as windows is not. – eriko Aug 17 '09 at 15:48

Set up a second user on the local machine with local admin rights. Something like "username_la". When the user wants to install something use "run as" or enter the alternate credentials when they are asked to authenticate the install.

This reduces the exploitable surface area of windows.


Add them as local administrators using restricted groups in Active Directory/Group Policy.


Add the AD account for the user to the local system's administrator (or power user, if possible) group.

I open the MMC (in XP with right clicking my computer and click on manage) then open the users and groups from the tree and from there in the groups add the domain user to the power user or admin group. They should be able to log in and add things as necessary from there.

As I alluded to in the comment, though, browse-by malware and such will also have admin access to that computer as that user is working.

  • The 'Power Users' local group in Vista has the same rights as the 'Users' Group. Its just there for backwards compatibility. – JS. Aug 17 '09 at 14:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.