Privileged Users Permissions

[mmoseley]

Hi All!

Hope your all having a better day than me today!

Got an issue we have removed a teachers admin rights, god knows how or why he had them!

We want him to be able to install software on only two machines and be able to change passwords for pupils.

How can this be done? Bear it in mind that we dont want to give him all rights, just be able to install stuff

Cheers!

[ChrisH]

You can delegate the ability to change passwords easy enough. Software installation is difficult though I would have though. The only awkward way I can think of is make him a local admin then lock him down through the local policy. Disallow control panel etc. Not sure if that would work though.

[penfold]

Create a local account on those 2 machines and get him to log on locally?

[SteveBentley]

Can you not do something along the lines of:

Create a GPO which gives Restricted Groups to assign his account to Administators.

Create a group which has the computer accounts of the two computers in that you want him to manage

Set permissions on the GPO so that they apply only to that group.

[TimTech]

You can make him a local admin on the 2 machines. NTFS permissions will still protect the network.
As for changing passwords, that can be done by giving him a custom MMC and delegating permissions for him in AD.

[RabbieBurns]

This post might help:

making staff local administrators

We are going to use the wisesoft password control for delegeted password changers