Solved

Groups and admin rights

Posted on 2002-05-08
7
152 Views
Last Modified: 2010-04-13
Topology:
Advanced server 2000 and 2000 clients.
We need to rollout various software.  My question is about User rights.  I dont want local admin rights to the client machine to install software.
What is the best way to assign temporary rights for program install.  For eg. In NT4.0 I would do the following:
1. Create a global group ie UserAdmins
2. Add this to the administrators group on each machine(client)
3. assign users to useradmins when required.
I dont really want to go around every machine doing this.
I have created a group UserAdmins on the 2000 domain and added users, also member of admin group global.
When the users logon they don't get any admin rights.  If i add them to the DomainAdmins group they get admin rights.
Cheers
0
Comment
Question by:bluez
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
  • 2
7 Comments
 
LVL 3

Expert Comment

by:Corvax021899
ID: 6996169
if all the machines are started you could run a script that would remotely add this global group to the local admin group.


Here is an example script in vbScript.

Dim oDomain 'For Domain Object
Dim oG_AdminGroup 'For Global Group
Dim oL_AdminGroup 'For Local Admin Group

Const DomainName = "Your Domain"
Const GlobalGroup = "Your GlobalGroup"

set oDomain = GetObject("WinNT://" & DomainName)
set oG_AdminGroup = GetObject("WinNT://" & DomainName & "/" & GlobalGroup)

oDomain.Filter = Array("Computer")

For Each Computer in oDomain
   set oL_AdminGroup = getobject("WinNT://" & Computer.Name & "/Administrators")
   oL_AdminGroup.Add oG_AdminGroup.AdsPath
Next

set oDomain = Nothing
set oG_AdminGroup = Nothing
set oL_AdminGroup = Nothing




0
 
LVL 1

Expert Comment

by:toshie
ID: 6997405
Why dont you assign or publish the software packages to the PCs at log on using an msi file.

The software can either be installed when the PC starts up or when the user first decides to use the program.

You can set up GPOs for each application. Or put themall together in a single GPO.

The other good thing about doing it this way is you can set up another GPO to uninstall the software when the user no longer requires it. (Good for license maintenance)

0
 

Author Comment

by:bluez
ID: 6998306
1.I have used icw for msi installs.
How do I do what you suggest ie publish package at startup, or when first run?
0
Migrating Your Company's PCs

To keep pace with competitors, businesses must keep employees productive, and that means providing them with the latest technology. This document provides the tips and tricks you need to help you migrate an outdated PC fleet to new desktops, laptops, and tablets.

 
LVL 1

Expert Comment

by:toshie
ID: 6998341
There are lots of articles describing deploying software in Windows 2000. For a description of the process

http://www.win2000mag.com/Articles/Index.cfm?ArticleID=9625

For a description on how to do it

http://support.microsoft.com/default.aspx?scid=kb;en-us;Q302430

I've used it several times for small scale rollouts (playing really) its not too difficult
0
 

Author Comment

by:bluez
ID: 7005669
Note:
I can use the net command
net localgroup administrators AdminUsers /add
This only works for local logon administrator
Does anyone have any ideas how to get this to work via the logon script
I made the presumption if the users where in an admin group they could run the command at logon, but not so.
Of course the simple way is to add users to DomainAdmins, but this leaves too much of a security hole ( local machines have global account domainusers logged in>
0
 
LVL 3

Accepted Solution

by:
Corvax021899 earned 50 total points
ID: 7005696
u would need a utility like superior su, or run the script i gave sooner from any Win2k machine on the domain, as long as you are domain admin and administrator of all the PC in the domain...

0
 

Author Comment

by:bluez
ID: 7010574
Thanks for all your input into this question.
0

Featured Post

Best Practices: Disaster Recovery Testing

Besides backup, any IT division should have a disaster recovery plan. You will find a few tips below relating to the development of such a plan and to what issues one should pay special attention in the course of backup planning.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
In order to fulfill our mission of inspiring learning in the technology community, Experts Exchange is launching a Course of the Month program. Premium and Team Account members will have access to one course per month as a part of their membership, …
Although Jacob Bernoulli (1654-1705) has been credited as the creator of "Binomial Distribution Table", Gottfried Leibniz (1646-1716) did his dissertation on the subject in 1666; Leibniz you may recall is the co-inventor of "Calculus" and beat Isaac…
The Email Laundry PDF encryption service allows companies to send confidential encrypted  emails to anybody. The PDF document can also contain attachments that are embedded in the encrypted PDF. The password is randomly generated by The Email Laundr…

726 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question