Answered by:
How do you give AD users the ability to install programs without making them a domain admin

-
I need to give certain users in Active Directory the ability to install programs. I added the users to the Administrators groups, however when I went to install a program, I kept getting a message saying that I don't have the rights to install.
If I add the user to the Domain Admin groups, then they are able to install programs, but that is giving the users way too much access rights.
Regards,
JOE
Question
Answers
-
Hi,
Based on my experience, user need have local administrative permissions (or member of the local Administrators group) to install patches. In MS domain environment, Local Administrators group is not a member of Domain Admin group. But on the contrary, Domain Admin group is member of Local Administrators group on domain-joined systems.
Add the users to the local admin group or power users groups on the workstations. That will give them the ability to install the software.
How to Make a Domain User the Local Administrator for all PCs
http://social.technet.microsoft.com/wiki/contents/articles/7833.how-to-make-domain-user-as-a-local-administrator-for-all-pcs.aspxAdd a member to a local group
https://technet.microsoft.com/en-us/library/cc739265(v=ws.10).aspx
Description of Group Policy Restricted Groups
https://support.microsoft.com/en-us/kb/279301
More articles for your reference:
Default local groups
https://technet.microsoft.com/en-us/library/cc771990.aspx
Installation permissions
http://technet.microsoft.com/en-us/library/cc781151(WS.10).aspx
How to assign software to a specific group by using Group Policy
https://support.microsoft.com/en-us/kb/302430
Best Regards,
Alvin Wang
Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.
- Proposed as answer by AlvwanMicrosoft contingent staff, Moderator Monday, January 25, 2016 9:49 AM
- Marked as answer by Amy Wang_Microsoft contingent staff, Moderator Wednesday, February 03, 2016 9:20 AM
All replies
-
You have not specifically mentioned this but I assume you mean on their own computers and not on the whole network.
Create an AD group with all the members who should be able to install software, and then add this group to the local Administrators group on each machines you want them to be able to install software on. If it is a large number of machines then you can use Group Policy to add the group to the local Administrators group.
-
Hi,
Based on my experience, user need have local administrative permissions (or member of the local Administrators group) to install patches. In MS domain environment, Local Administrators group is not a member of Domain Admin group. But on the contrary, Domain Admin group is member of Local Administrators group on domain-joined systems.
Add the users to the local admin group or power users groups on the workstations. That will give them the ability to install the software.
How to Make a Domain User the Local Administrator for all PCs
http://social.technet.microsoft.com/wiki/contents/articles/7833.how-to-make-domain-user-as-a-local-administrator-for-all-pcs.aspxAdd a member to a local group
https://technet.microsoft.com/en-us/library/cc739265(v=ws.10).aspx
Description of Group Policy Restricted Groups
https://support.microsoft.com/en-us/kb/279301
More articles for your reference:
Default local groups
https://technet.microsoft.com/en-us/library/cc771990.aspx
Installation permissions
http://technet.microsoft.com/en-us/library/cc781151(WS.10).aspx
How to assign software to a specific group by using Group Policy
https://support.microsoft.com/en-us/kb/302430
Best Regards,
Alvin Wang
Please remember to mark the replies as answers if they help and un-mark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.
- Proposed as answer by AlvwanMicrosoft contingent staff, Moderator Monday, January 25, 2016 9:49 AM
- Marked as answer by Amy Wang_Microsoft contingent staff, Moderator Wednesday, February 03, 2016 9:20 AM