Win 8.1 Domain User Issue

[djameson]

We have just received new HP 810 G2 Revolve laptops for our teachers. We are moving to Win 8.1 Update 1. We've had several issues but the one I am dealing with right now I can't seem to get a handle on.

 

When a domain user logs in, everything works fine. But if they try to access PC Settings or make any "changes" or attempt to download and install an app or program, they are prompted with a log in box asking for the administrators credentials.

 

How can I give domain users the rights to make changes and install apps and programs? Preferably, I'd like to accomplish this through Group Policy.

 

Any help would be greatly appreciated!!

 

Thanks in advance for you time.

[SYNACK]

Do you really want teachers installing stuff on laptops, that is the quickest path to hell.

 

If you really want then I would make a group of team leaders in the school some additional accounts on the network usernamea and then use group policy to add this group to the administrators group on just the laptops with the restricted groups bit of group policy under computer security.

 

They should not be logged on as admins for general use as that just adds more issues and really if you want them to keep working reliably you don't want them attempting to install ever little thing a banner ad says is a good idea anyway. At least if they have to go to a team leaser and ask it slows down the - my computer is slow... no its always had imesh and 86 toolbars on it - idiocy a little.

[djameson]

Do you really want teachers installing stuff on laptops, that is the quickest path to hell.

 

If you really want then I would make a group of team leaders in the school some additional accounts on the network usernamea and then use group policy to add this group to the administrators group on just the laptops with the restricted groups bit of group policy under computer security.

 

They should not be logged on as admins for general use as that just adds more issues and really if you want them to keep working reliably you don't want them attempting to install ever little thing a banner ad says is a good idea anyway. At least if they have to go to a team leaser and ask it slows down the - my computer is slow... no its always had imesh and 86 toolbars on it - idiocy a little.

 

We have allowed teachers to download and personalize their laptops for years (from Xp to win7). Yea we have some issues but overall it's been fine.

 

The issue is the new apps that curriculum wants them to explore and also the installation of printers and such. I don't want to install all apps and things for over 500 teachers!!

 

Again, we would like to give them the rights. Any one know the gop settings we would need to adjust for win8.1?

 

Thanks.

[edutech4schools]

All my users at all my schools are local admins and we have had no real issues and its been that way for 8 years. I think we get less help requests since making them local admins as they can install what they want etc and they can do what they need if they take the laptops home.

 

Anyway

Does it all work OK if a user is local admin? What about as a power user?

You might want to look at UAC, although MS stop you using the App store with that disabled.

[SYNACK]

use group policy to add this group to the administrators group on just the laptops with the restricted groups bit of group policy under computer security.

 

Its easy Using Restricted Groups

Cleaning up the mess the staff make on the other hand

 

Florian’s Blog » How to use Restricted Groups? Part I

 

 

Again I recommend you make new admin accounts for the teachers to use only when prompted for credentials, running as an admin all the time is stupid and dangerous even with UAC watching your back. Better to add a separate admin user account for each teacher so that when they are prompted for elevation they can use that rather than just dispensing with security in its entirety by running as local admin all the time.

[djameson]

Anyway

Does it all work OK if a user is local admin? What about as a power user?

You might want to look at UAC, although MS stop you using the App store with that disabled.

 

As far as I can tell through my testing, everything works fine until the teachers attempted to download and install a program, app, or a printer. Also, during a training session they found they didn't have access to the PC Settings to change lock screens and home screens. Have not tested as a power user. Will test more Tuesday.

 

Synack...I sincerely appreciate your help and understand your opinion. However, we have allowed teachers to be the local admins of their machines since XP. The boss expects Win 8.1 to operate the same way for teachers so I have been tasked to "fix it" as he likes to say!

 

Thanks again for all the comments and help.

Edited May 25, 2014 by djameson

[djameson]

I believe I have the issue worked out now. As usual, user error!!

 

On to the next issue.

 

Thanks again for all the suggestions.