none
How to allow non-admin users to install software and applications

    Question

  • TI am sure this issue have been discussed before several times, but i am still confused about it. i have many user i need to allow them install applications without grant them local admin privileges. and if its not passable and i grant them local admin privileges can i restrict them from change IP address of there machines?
    Wednesday, March 13, 2013 1:25 PM

Answers

All replies

  • By nature, administrators can change anything on the machine. That is the purpose of being an administrator.

    The best solution is to define the applications that they need and then to deploy those applications to them. You can use SCCM, Group Policy, scripts, etc to achieve this.

    Wednesday, March 13, 2013 1:57 PM
  • Hello,

    why don't you use GPO with computer or user configuration to install the software, that way no user requires admin permissions?

    And either you make them local admin with ALL consequences or not. If the software installation requires access to the system folders it may sometimes work with the Power users group but most of the time local admin permissions are required. Test it with the software they have to use.


    Best regards

    Meinolf Weber
    MVP, MCP, MCTS
    Microsoft MVP - Directory Services
    My Blog: http://msmvps.com/blogs/mweber/

    Disclaimer: This posting is provided AS IS with no warranties or guarantees and confers no rights.

    Wednesday, March 13, 2013 1:58 PM
  • Hi Khalid,

    As Meinolf mentioned, we could use GPO with computer or user configuration to install software.

    This video is about installing software through Active Directory's Group Policy

    http://www.youtube.com/watch?v=JRNCgvZs5v4

    Meanwhile, this article may be helpful:

    Beat Practice: How to Deploy Software Using Group Policy

    http://www.grouppolicy.biz/2011/04/best-practice-how-to-deploy-software-using-group-policy/

    Hope this help!

    Regards.


    Vivian Wang
    TechNet Community Support

    Thursday, March 14, 2013 6:04 AM
    Moderator
  • Hi J.. we do have SCCM and we are using it for many software's such as Office, but cant use it for all users applications whiles our user need to install to many different apps like Apple Itunes and Samsung Kies and many more, not that we have over 600 users most of them out of the head office.

    i think it will be so complicated for me to use SCCM for this, am i right? 

    ample thanks for your responds  

    Saturday, March 16, 2013 6:59 AM
  • thank's for your replay

    Power user it doesn't work with many apps .exe and we need to allow our managers to only install software's without asking it department for that

    i hope u got my point,

    thanx many. 

    Saturday, March 16, 2013 7:05 AM
  • Thanx V,

    the same i need no deploy certain software, i need to allow some users to install whatever they need to install without calling IT dept.

    thanx

    Saturday, March 16, 2013 7:09 AM
  • Hello,

    if power users are not high enough you have the answer, they must become local admin. So either you have to accept this or manage the software remote.


    Best regards

    Meinolf Weber
    MVP, MCP, MCTS
    Microsoft MVP - Directory Services
    My Blog: http://msmvps.com/blogs/mweber/

    Disclaimer: This posting is provided AS IS with no warranties or guarantees and confers no rights.

    Monday, March 18, 2013 8:18 AM
  • check out this links below:

    How to assign software to a specific group by using Group Policy --> http://support.microsoft.com/kb/302430

    Deploying a MSI through GPO --> http://www.advancedinstaller.com/user-guide/tutorial-gpo.html


    Every second counts..make use of it.

    Monday, March 18, 2013 9:16 AM
  • Am 16.03.2013 07:59, schrieb Khalid Ibrahim:
    > many different apps like Apple Itunes and Samsung Kies
     
    If only one user needs it: Install it manually and put a schedule in
    your calendar to update it. If more than one user needs it: Automate it
    for unattended deployment.
     
    In any case: Do NOT grant admin rights to your users. Don't do that.
    Don't! Why not? If you do so, the computer is out of your control...
     

    NO THEY ARE NOT EVIL, if you know what you are doing: Good or bad GPOs?
    Wenn meine Antwort hilfreich war, freue ich mich über eine Bewertung! If my answer was helpful, I'm glad about a rating!
    Monday, March 18, 2013 7:56 PM
  • Am 16.03.2013 08:09, schrieb Khalid Ibrahim:
    > i need to allow some users to install whatever they need to
     
    No, you don't. Regardless of what others are saying: Users MUST NOT have
    the need to install whatever they want to in a corporate environment.
     

    NO THEY ARE NOT EVIL, if you know what you are doing: Good or bad GPOs?
    Wenn meine Antwort hilfreich war, freue ich mich über eine Bewertung! If my answer was helpful, I'm glad about a rating!
    Monday, March 18, 2013 7:58 PM
  • You  can always use GP to publish a list of pre approved software that users can install when they need 

    See this link 

    http://technet.microsoft.com/en-us/library/cc783635(v=ws.10).aspx

    Tuesday, March 19, 2013 9:48 AM
  • Hello,

    maybe Windows Intune is an option for you depending on the installation requirements

    http://www.microsoft.com/en-us/windows/windowsintune/explore.aspx


    Best regards

    Meinolf Weber
    MVP, MCP, MCTS
    Microsoft MVP - Directory Services
    My Blog: http://msmvps.com/blogs/mweber/

    Disclaimer: This posting is provided AS IS with no warranties or guarantees and confers no rights.

    Tuesday, March 19, 2013 10:33 AM
  • thanks' all

    it was beneficial for me, I'll never think about grant a normal user to admin user, so I have to work hard to deal with this.

    thanks' for all

    Tuesday, March 26, 2013 12:36 PM