How do I give a certain right to a user?

[josh0227]

We have a user who need the right to install applications on his own machine, while he is logged into the domain. What group do I add him to to allow him to do this?

 

[Davetoo]

He needs to be a local admin...maybe power user...can't remember if a power user can install locally.

I'm Certifiable, not certified.
It just means my answers are from experience, not a book.

 

[josh0227]

I realize that is the case locally on their workstation, however I don't believe that is the case when they log onto the domain. Don't the domain policies/permissions override the local policies when logged in? I don't believe the local and domain SID's sync, do they? I would like to prevent adding someone to the local admin group on their own pc, because if they would want to install something, they would have to log out of the domain, then log in locally which are more steps than I think is required. Some of the programs that they have to install require them to be logged into the domain, and accessing domain resources/programs while they install additional programs/additional program add-ons. Please let me know if this doesn't make sense.

Thanks!

 

[ouzojd]

I think what you want would be to add a user in the form of domainname\username to the local computer then add that user to whatever local group on the machine.

 

[josh0227]

I sort of understand what you are referring to, however could you give me a simple step by step on how to do this? I know how to add permissions, and user groups to a user, however I am unsure as to what you mean regarding how to add a domain user to a local account.

Thanks

 

[mrmoneymatters]

Go to the user's workstation. Log on as an admin of that workstation or the domain admin. Right click on my computer, click on manage. Expand local users and groups, click on groups, double click on administrators, click add, then click advanced, then find now. At this point it should be displaying all domain accounts, find and select the user you want to add. Click ok three times.

Network Admin
A+, Network+, MCSA 2000, MCSE 2000

 

[ouzojd]

Sounds good to me, just one other thing which you have probably worked out, but I think at the top of the box after you click add it defaults to look at users already added to the local workstation, you will need to change the drop down to your domain.

You can also add users to groups in Active Directory if the PC is turned on by right clicking on the computer in AD and selecting manage, you can then get to users and groups for that PC from there.