locked
Domain users cannot install any software in their machines !!! RRS feed

  • Question

  • Hi,

    I am a network administrator, I installed recently a domain controller in our Enterprise  but after deploying it, domain users have not the right to install any software, knowing that we are a development society so we need all the time to install software, how could it be done? to give all the domain users privileges to install software and at the same time to make a blacklist to deny the install of some others.

    at the moment I give them the administrator privileges in their machines to solve this problem until I will find the solution. 

    It's an urgent matter please help :( !!!

    Friday, September 27, 2013 9:14 AM

Answers

  • You could create a Restricted Groups GPO by specifying a group that is part of the local administrators group on each machine. Users in the group will automatically be part of the local admin group and can do whatever they need on it.

    If you are trying to restrict that to only install software, that's a bit more tedious. Instead of using the local administrators group in the Restricted Groups GPO, you can use Power Users.

    Good discussion about Restricted Groups with a complete step by step: (just substitute Power Users group for Local Administrators group)
    Technet thread: "AD Question, Group as Administrator?" 3/13/2012 - Read the step by step I posted:
    http://social.technet.microsoft.com/Forums/en-US/winserverDS/thread/880ad98a-f6bd-4132-ac8b-441d721e2762/

    -

    Using Restricted Groups in conjunction with Software Restriction Policy (see TylorWang link in his post), you can control what they can install and not install.


    Ace Fekay
    MVP, MCT, MCITP/EA, MCTS Windows 2008/R2 & Exchange 2007, Exchange 2010 EA, MCSE & MCSA 2003/2000, MCSA Messaging 2003
    Microsoft Certified Trainer
    Microsoft MVP - Directory Services
    Technical Blogs & Videos: http://www.delawarecountycomputerconsulting.com/

    This post is provided AS-IS with no warranties or guarantees and confers no rights.

    FaceBook Twitter LinkedIn

    • Proposed as answer by bshwjt Monday, September 30, 2013 6:43 AM
    • Marked as answer by Amy Wang_ Friday, October 4, 2013 2:12 AM
    Monday, September 30, 2013 3:50 AM

All replies

  • Here is an article for your reference:

    http://technet.microsoft.com/en-us/library/cc782792%28v=WS.10%29.aspx

    This is the forum to discuss questions and feedback for Microsoft Office, better to post your question to the forum for Windows Server.

    The reason why we recommend posting appropriately is you will get the most qualified pool of respondents, and other partners who read the forums regularly can either share their knowledge or learn from your interaction with us. Thank you for your understanding.

    Monday, September 30, 2013 2:51 AM
  • You could create a Restricted Groups GPO by specifying a group that is part of the local administrators group on each machine. Users in the group will automatically be part of the local admin group and can do whatever they need on it.

    If you are trying to restrict that to only install software, that's a bit more tedious. Instead of using the local administrators group in the Restricted Groups GPO, you can use Power Users.

    Good discussion about Restricted Groups with a complete step by step: (just substitute Power Users group for Local Administrators group)
    Technet thread: "AD Question, Group as Administrator?" 3/13/2012 - Read the step by step I posted:
    http://social.technet.microsoft.com/Forums/en-US/winserverDS/thread/880ad98a-f6bd-4132-ac8b-441d721e2762/

    -

    Using Restricted Groups in conjunction with Software Restriction Policy (see TylorWang link in his post), you can control what they can install and not install.


    Ace Fekay
    MVP, MCT, MCITP/EA, MCTS Windows 2008/R2 & Exchange 2007, Exchange 2010 EA, MCSE & MCSA 2003/2000, MCSA Messaging 2003
    Microsoft Certified Trainer
    Microsoft MVP - Directory Services
    Technical Blogs & Videos: http://www.delawarecountycomputerconsulting.com/

    This post is provided AS-IS with no warranties or guarantees and confers no rights.

    FaceBook Twitter LinkedIn

    • Proposed as answer by bshwjt Monday, September 30, 2013 6:43 AM
    • Marked as answer by Amy Wang_ Friday, October 4, 2013 2:12 AM
    Monday, September 30, 2013 3:50 AM