Power users rights

Ensure to take heed of the warnings.  You want to use the lower of the two boxes to add the restricted group as a member of another group.  You cannot use browse to find "Power Users" group so simply type it in ensuring to spell it correctly as again there is no validation for you here since this group would not exist on a domain controller typically.

 LucF

 I more then agree with you, exactly I'm looking to give the users rights to do windows update, install printers and update software like flash..

Can and how will I go about doing this without giving the users Power Users right?

I would be more then willing to do it without giving the users Power users rights

 mwvisa1


 Understood , thanks

Same answer really, through Group Policy Object.

This reference will show you how to configure automatic updates:
http://technet.microsoft.com/en-us/library/cc720539(WS.10).aspx

For enabling or disabling, you will need to edit policy under:
User Configuration | Administrative Templates | Start Menu and Taskbar
(http://www.tech-archive.net/Archive/Win2000/microsoft.public.win2000.active_directory/2006-04/msg00057.html)

If you research GPO, you will find you can do most of what you need here as pointed out.

  mwvisa1

If I understand correctly I can allow a simple domain user to install windows updates using the 2nd link that you posted, or do I have to use both in combination?

noad:

The 2nd is what you need to enable access to Windows Update.  The first is if you wanted to make things happen automatically without intervention of user.

M-1

  if I use the 2nd link can the users remain domain users, with out being power users or local administrator?

Sorry for the redundant questioning, just want to get it right...

noad:

That is my understanding.  It has been a while since I had to set mine up and haven't needed to change.  May have had to change another right under User Rights Assignment, so will double check tomorrow unless LucF has handy.

M-1

thanks
will wait for your reply tomorrow

Hi noad,

Sorry for the late reply, it was kind of busy at work today.

As mwvisa1 mentioned, all can be arranged through GPO's.
One thing you might want to think about is your users. Will they remember to actually update all those applications?

For the things you mentioned:
- Push printerdrivers and connections by GPO</A>
- Push new versions of Flash/Adobe reader/Java/name whichever other program, which will require frequent updates by GPO</A>
- Push updates through WSUS

Doing so yourself will make sure applications get their updates and the users don't need to do anything themselves. This will make the most secure environment with the least troubles.
Guess who's going to be blamed if security issues occur on the network and higher management finds out that patches were not installed (Does the phrase "Hey, it's easier to leave my computer on at night instead of rebooting it once in a while" ring any bells?) So my opinion is to take care of it for all my users instead of having them to do it, in case you're handling a big network also bandwidth might be a reason to take care of it yourself. Imagine how much bandwidth is used when all computers on your network try to download Windows XP SP4 (or whichever) at the same time instead of downloading it once and pushing it over the local network to the clients.

Regards,

LucF

 I more then agree with you, but it's not up to me to make that call, I have and I am trying to explain that power users are a very bad idea. I have made it very clear so no I can only hope.

An WSUS is not in the near future ( no money)

As for mwvisa1 post the 2nd link will I be able to just allow users to do windows updates without making them power users?

Is there a policy that can allow me to just give domain users the right to download and install updates?

We use WSUS in the small company I work for.  It is free!
http://technet.microsoft.com/en-us/wsus/default.aspx

mwvisa1


 Free as in software, but don't you want to put that  on it's own server?

 mwvisa1

Any idea what it should run on?
How much CPU power, memory, H.D ect...?

True, it is license free, but you do need to run it somewhere.  We have the luxury of having had a box big enough to virtualize it onto using ESXi (the embedded / free version of VMWare ESX) and we allocated 2GB of memory if I am not mistaken an one CPU but it is new machine so has pretty decent rating.  Biggest thing when we had it on a smaller box was the memory to be able to administrate the system while it is running its services (we only had 512MB, so higher than 512MB as that worked for doing updates just slow).  Hard disk, we have around 40-50GB allocated now IIRC as you have all the packages downloaded there so over time hard drive also important as a lot of the patches / service packs are getting bigger and bigger.