Using Group Policy to allow a user to install software

[kaphc]

Our ICT Co-ordinator has asked to have access to be able to install software, e.g. a new font, drivers for a new piece of IT eqpt etc. As I work 6 hours a week, this seems like a reasonable request, given that we've agreed how to log what he installs for auditting purposes etc.

 

I'm trying to provide him access to do this via another login which I have given more access rights to via Group Policy. However, given that installing software writes to the registry and c:\windows etc. I'm wondering whether this is achievable.

 

Has anyone else got this working and if so, can you advise which group policy settings need enabling?

 

I also thought about setting somethign up via a Power User, but this has been deleted from our Active Directory by the previous postholder by the looks of it.

 

Thanks

[cookie_monster]

Power users is still available on local stations it's not a domain group.

 

Power users still have limitations that will cause all sorts of issus with bits of software i'd look into using restricted groups to make the person a local admin on certain stations. As power users is a subset of the administrators group not a superset of users it really doesn't provide much protection so you will save yourself hassle using a local admin.

 

Using Restricted Groups

[kaphc]

That'll be why I couldn't find it in Active Directory then lol!

 

Thanks, cookie Monster, will take a look at Restricted Groups and see if that will do the trick.

[azrael78]

As cookie_monster just said - Local Admin rights may be the way to go, however if you combine these rights with group policy restrictions - you could give him the underlying rights while removing some of the more dangerous parts in theory.

 

Another way you could do it - is to add him to a domain group and grant that group specific admin rights on a local PC, particularly c:\windows etc...

 

So that they have the underlying rights to install software like an admin would, but they don't have some of the other parts.

 

It all depends how you want to do it really - we just give people local admin where they need it and if they break the PC, they live without it for a while - we eventually get around to it, they lose their local admin rights and we reimage the PC in question.

 

Fortunately though we have a very limited audience who have any kind of admin rights

 

Az