Admin but not quite full admin rights

[SteveB_NI]

Hopefully someone can advise me on the best way to go about this issue!

 

I have a staff member who requires local admin access to workstations in the classrooms they teach in (to run some exes - they are blocked to everyone except when run as admin is clicked)

 

I do not need them / want them for obvious security reasons to have access to active directory, other server functions but the only way I've worked out to do it so far is to give them administrator rights by making them part of the admin account group.

 

Would there be a group / something I can assign the user account to which gives them local admin access to run exes on different stations (win 7 clients) but limiting access to the rest of things like other staff accounts.

 

Thanks in advance

[snagrat]

Just give them local Administrator rights by putting them in the local Administrator group

[mukz]

If it is just to run I'm pretty sure their is a local group which is not admin but allows .exe files to be run