Installing EXE programs without Domain Admin user

[Guest integrii@gmail.com]

Read the post on my blog if you like:

http://blog.integrii.net/?p=102

 

It says:

 

 

 

No really; how do you do it?

 

I’ve looked through all of group policy and the closest you can get

that I’ve seen is to allow installs with ‘elevated privileges’ which I

then found out ONLY applies to MSI packages… not EXEs. What I really

want is for whatever user is logged in to be the full local admin of

the computer they are sitting at.

 

The trick? Do it remotely without ever logging into the remote

computer locally. It would be far too annoying to go to each computer

and manually specify that their user is part of the bulitin/

administrators (local admins) group. Oh yeah, thats not even an option

on Vista either. All remote computers have a different random password

set for the Administrator.

 

So, without granting someone ‘Domain Admin’ privileges, how do I

enable users to install software on their own? Currently I have to RDP

to each machine every time someone wants Firefox installed! Let alone

they aren’t even allowed to setup a tunnel using OpenVPN’s software.

 

So, I ask you internet, how do you make this happen?

[Guest Meinolf Weber]

Re: Installing EXE programs without Domain Admin user

 

Hello integrii@gmail.com,

 

Even if your posting is more sarcastic then useful, a lot of .exe files can

be run with additional switches for silent install with a startup script.

 

If there still is the need to install some software from users as local admins,

you can use the "Restricted groups" with a GPO like described here:

http://www.frickelsoft.net/blog/?p=13

 

Best regards

 

Meinolf Weber

Disclaimer: This posting is provided "AS IS" with no warranties, and confers

no rights.

** Please do NOT email, only reply to Newsgroups

** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm

> Read the post on my blog if you like:

> http://blog.integrii.net/?p=102

> It says:

>

> No really; how do you do it?

>

> I’ve looked through all of group policy and the closest you can get

> that I’ve seen is to allow installs with ‘elevated privileges’ which I

> then found out ONLY applies to MSI packages… not EXEs. What I really

> want is for whatever user is logged in to be the full local admin of

> the computer they are sitting at.

>

> The trick? Do it remotely without ever logging into the remote

> computer locally. It would be far too annoying to go to each computer

> and manually specify that their user is part of the bulitin/

> administrators (local admins) group. Oh yeah, thats not even an option

> on Vista either. All remote computers have a different random password

> set for the Administrator.

>

> So, without granting someone ‘Domain Admin’ privileges, how do I

> enable users to install software on their own? Currently I have to RDP

> to each machine every time someone wants Firefox installed! Let alone

> they aren’t even allowed to setup a tunnel using OpenVPN’s software.

>

> So, I ask you internet, how do you make this happen?

>