DLL registration under a normal user account

Our desktops are locked down, which prevents users from installing unauthorized applications. One of our home grown applications can update it's self using a command script, but trying to register a DLL or OCX may fail under a normal AD user account. They also have no local admin rights either.

I've built a WinForm shim program that can  invoke the update using elevated rights to accomplish the task and for now, used my admin account for test purposes. The shim is invoked by the logged in user that currently does not have the rights to do what is required and I don't want to run around every machine to perform the updates.

The question is, what are the minimal group(s) required to permit DLL or OCX registration? Must you be an administrator to do this or can one of the other groups (ie. Power User) provide that ability?

I was thinking of creating a special user account for the shim, for the purpose of the update and DLL/OCX registration on WinXP and only provide the minimal group rights to carry out the task. I couldn't find anywhere what group would allow regsvr32 to register the DLL or OCX file without an error.

Maybe there is a better way to do this?
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

1.  Power Users Group.
2.  Grab Dial a Fix [very nifty program]

You can also

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
WebGeeksUnlimitedAuthor Commented:
I'll try the Winform shim I build, with the installer account I created, place it into the power user group and see how that works out.
By the way, just curious, is there a spot out at MSDN that documents what each group can do in WinXP? I've poked around looking for that detail, but maybe I'm not searching the right way.
I'm also not sure if after the "You can also" text if there was suppose to be something else, as it appears blank ...
WebGeeksUnlimitedAuthor Commented:
The power users group was sufficent to make it work. Thanks.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows XP

From novice to tech pro — start learning today.