Admin with limited permissions

[wodbud]

Can anybody help me with my case? I need to create user which can only update one specific application and administering group of computers.

Local admin for group is easy, I've configured that but I don't know how to set access to one app.

If I create administrator, he will set any of services on machine, I don't want that. Is there any universal method for such case?

[Roberto]

I don't think there is. You can maybe lock things down to some degree (delegate rights, use policies to try and hide things) but a user account is either an administrator account or it isn't.

[Michael]

As above, you can look at delegated rights for Group Policy. In terms of limiting to just one other application, that's a little more tricky, unless you have a VM instance with just this specific application installed?

 

Another possibility is seeing whether there's a client that will talk to the server instance (say from Windows 10), depending what application it is. Group Policy can of course be controlled via RSAT also.

Edited December 17, 2015 by Michael

[wodbud]

As I checked, that app doesn't write anything to the registry. So I think that I'll create normal user and give permissions only to that specific app folder. It could be harder if app installer need admin permissions. That app doesn't need (installer doesn't ask for admin permissions at startup).