Limited Admin Account

[LTurner3692]

Hello,

 

is there a way i can create/modify accounts in admin to be able to run .exe and update programes without needing the full admin rights?

 

We have offices around the world and doing this would be able to stop most of my night time calls down!

[Rob_D]

Isn't this what the "Power Users" local group is for?

[LTurner3692]

@Rob_D i am unsure! would make my life a little easier if it was!

[Rob_D]

It was pretty much designed for your use case and would AFIK allow them to do everything you want. It's just a question of whether it gives them too much power. Which would probably take some testing. At the very least, it makes for a good starting point.

[LTurner3692]

ill start with looking at that!

 

Thank you.

[HPlum78]

I am sure that the Power Users group in Windows 10 has no more permission than any standard user these days? (if you are using win 10)

 

Also you should really try not to add domain accounts to workstation local groups if you can. Can you not just create a local user with the required permissions and have them elevate when required?

 

If you use Laps then with a bit of PowerShell you can expose that to the user when they request it and then at the next gp refresh the permissions are removed. No need for a restart as the permissions are injected in to user token.

 

(that's all from memory so I could be wrong on the group bit of win 10, no access to any win client....)

 

https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/implementing-least-privilege-administrative-models

Edited June 7, 2019 by HPlum78

[LTurner3692]

Problem i have is the offices that need it are in China, HK, NZ and OZ, most don't tell us in time when they want it.

 

being able to give one person in those locations the access to install means i dont get a 2/3am wake up just to install something.

[Arthur]

Do any of your offices have SCCM?

 

If so, you could add the required software to the Software Center which would allow end-users to install the apps themselves without admin rights.

[HPlum78]

But with either way you create or devolve the permissions either up front via a local user account, or scripted its down to the end user clicking a button.

 

You should have a process for requesting local admin/ more priveledged access. If you script it then it can be logged and the you can audit and then you know when your workstations are empire'd!

[steve]

If you have a decent budget something like this would be what I'd buy: https://www.beyondtrust.com/endpoint-privilege-management/desktops

[mavhc]

Hello,

 

is there a way i can create/modify accounts in admin to be able to run .exe and update programes without needing the full admin rights?

 

We have offices around the world and doing this would be able to stop most of my night time calls down!

 

Could add write permissions to the dir the program is stored in, and the registry key. Case by case basis. If it's installed in Program Files other parts might still complain though. And in general this will break SRP, so now you'll get ransomware again. Assuming you set up SRP