Hi,
Based on my experience, user need have local administrative permissions (or member of the local Administrators group) to install patches. In MS domain environment, Local Administrators group is not a member of Domain Admin group. But on the contrary, Domain
Admin group is member of Local Administrators group on domain-joined systems.
Add the users to the local admin group or power users groups on the workstations. That will give them the ability to install the software.
How to Make a Domain User the Local Administrator for all PCs
http://social.technet.microsoft.com/wiki/contents/articles/7833.how-to-make-domain-user-as-a-local-administrator-for-all-pcs.aspx
Add a member to a local group
https://technet.microsoft.com/en-us/library/cc739265(v=ws.10).aspx
Description of Group Policy Restricted Groups
https://support.microsoft.com/en-us/kb/279301
More articles for your reference:
Default local groups
https://technet.microsoft.com/en-us/library/cc771990.aspx
Installation permissions
http://technet.microsoft.com/en-us/library/cc781151(WS.10).aspx
How to assign software to a specific group by using Group Policy
https://support.microsoft.com/en-us/kb/302430
Best Regards,
Alvin Wang
Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.
