We help IT Professionals succeed at work.

Active directory rights

Medium Priority
Last Modified: 2011-09-20
How do you create a active directory user that has rights for installation of software on a 2003 server without giving them admin privileges?
Watch Question

You don't. If it's a member server you can make them a member of the Power Users group, but the elevation of privilege attack for a Power User to make themselves an Administrator is well-known, published, and trivial.  

If it is an absolute requirement for the user to install their own software on a server, make them an administrator for only the amount of time that they require that ability, and then remove them from the Administrators group.

Explore More ContentExplore courses, solutions, and other research materials related to this topic.