mtupker

I've deployed MS Office using GPO many times with no problems whatsoever. Have you experienced problems with this? Did you do the admin install and use the ORK to create a custom MST? our users get really upset if login take more than usual. That why we don't deploy office through GPO. WPKG is a different story though. It installs softrware at computer startup but the user can login during the install. I just started using it so it may actually work for Office deployment. I've also heard rumors that Office 2007 doesn't deploy well through GPO.

we use a combination of wpkg and Active directory GPOs. I wouldn't recomend trying to deploy large apps with either of them though. (I'd consider MS Office and large app)

I agree that this is a very dangerous game. We had an incedent where a high level employee wanted to have one of our spare laptops to give to their kid as a birthday present. (very tacky and probably illegal) We don't keep spare laptops so it was really a non-issue since the birthday was two days away. We're still trying to figure out how deal with stuff like this.

Thank you everyone for all the input. I'm positive that something to do this could be setup but I don't think it could be done securely given the nature of what local admin rights gives a person. If I ever do get something written I'll post my solution.

yeah I was considdering that. There really is no good way to do this without being able to hide the scheduled task. I suppose there could be a AD start up script that could reset admin rights to default at every computer bootup.

That would be one way to do software installs. However, I think that method will cause an installer to run under a different security context than the account that is logged in. (I've run into problems with that before with program installers that only install per user. It really depends on the application installer.) I'll investigate that option a little more though. Currently, when we have a situation that required admin rights for installation under the security context of the user that is logged in, we have to that user out, login as an admin, grant that user admin rights, logout, have the user log back in and install the program, and then we would need to log back in to remove the admin rights. I may just write something to do this as a desktop app. After thinking about it a little more, it's possible to query a computer the currently logged in AD username. That user could then be added to the local admin group. A logoff would be required. The admin rights for that user could then be removed using a computer startup script or through my previous idea of a scheduled task (or both). Of course I may be making a relativly simple issue more complex than it needs to be.

This is probably a tall order. At a privious job I was at someone had developed a script to grant temporary local admin rights to a user. (for the purpose of allowing users to install software.) I think the script was vbs based. I was just wondering if anyone had seen anything like this. The only way I can come up to do this, in theory, is for a script to add the currently logged on user to the local admin group of the computer and at the same time create a scheduled task that will remove the rights in x amount of time. There are some obvious flaws with this approach though. I also found this http://blogs.msdn.com/aaron_margosis/archive/2004/07/24/193721.aspx but I haven't had time to look into it yet to see if it what I'm looking for. Thanks.