Security rights issue

[fgaston]

We are running into following consistently:
For some programs installed across the network, they install fine when logged as domain admin, but domain user rights are not enough for user & users get errors. Plus admins must go around everytime someone needs a change.

Obviously we can make everyone a domain admin but...

domain users have been added to local admin group as well as other changes to local security policy.

How do others balance need for some security with giving users some autonomy for installation and avoiding programs requiring full domain admin rights to run properly? Thanks in advance.

 

[pbxman]

Whoa - domain users with local admin permissions? Yikes. I'd try adding them to power users forst..save admin rights for only the most critical situations.

Power Users gives plenty of access for most functions. If you have specific programs users need admin rights, you could try using regedit32 to set elevated permissions on only the registry keys used by the program itself. Basically - all local admin rights does is grant full control to the registry. Users have very limited access to the registry, and are mostly read-only.

It might take some time to figure it out, but dont give up too easily and add domain users as local admins. Thats asking for trouble in anything larger than a 10-user network.

Good luck!
Pbxman
Systems Administrator

Please let Tek-Tips members know their posts were helpful.