?
Solved

Domain users to install printer drivers and specific software only...

Posted on 2010-04-06
7
Medium Priority
?
979 Views
Last Modified: 2012-05-09
We have quite a few clients having received new computers with win7pro.  They are domain users under a w2008r2 domain.  They don't have the local admin password because I wanted to prevent that they install all kind of crappy software.

However I DO want them to be able to install printer drivers for their home printers, AND also to update Java, Windows Updates and preferable updates to all the software already installed (OpenOffice, Mozilla stuff etc...)

HOW do I solve this in an elegant way?  I wish windows had a permission type called 'Update any existing software'..  I tried to enable the GPO which allow users to install printer drivers, but it does not seem to work or give the desired effect.  At least their computers still yell for an admin when needing printer driver installers or updates.

Thanks for comments, good advice and howtos to elegantly allow users to maintain the software in their computers without giving them permission to install anything ...

Geir
0
Comment
Question by:geir056
  • 3
  • 2
  • 2
7 Comments
 
LVL 8

Expert Comment

by:ggefter
ID: 29908225
if you add them to the power users group that should take care of most of your problems.

Power Users

The Power Users group primarily provides backward compatibility for running non-certified applications. The default permissions that are allotted to this group allow this group's members to modify computerwide settings. If non-certified applications must be supported, then end users will need to be part of the Power Users group.

Members of the Power Users group have more permissions than members of the Users group and fewer than members of the Administrators group. Power Users can perform any operating system task except tasks reserved for the Administrators group. The default Windows 2000 and Windows XP Professional security settings for Power Users are very similar to the default security settings for Users in Windows NT 4.0. Any program that a user can run in Windows NT 4.0, a Power User can run in Windows 2000 or Windows XP Professional.

Power Users can:

• Run legacy applications, in addition to Windows 2000 or Windows XP Professional certified applications.
 
• Install programs that do not modify operating system files or install system services.
 
• Customize systemwide resources including printers, date, time, power options, and other Control Panel resources.
 
• Create and manage local user accounts and groups.
 
• Stop and start system services which are not started by default.
 

Power Users do not have permission to add themselves to the Administrators group. Power Users do not have access to the data of other users on an NTFS volume, unless those users grant them permission.

0
 
LVL 59

Accepted Solution

by:
Darius Ghassem earned 2000 total points
ID: 29909522
For a user to  install programs or printer drivers they must be part of the local admin or Power user groups.

You can configure this through a GPO.

http://www.windowsecurity.com/articles/Using-Restricted-Groups.html

http://support.microsoft.com/kb/279301
0
 

Author Comment

by:geir056
ID: 29925784
Thanks both of you.  

I haven't seen the Power User group in the domain AD groups (I'm not at work now).  

If this is a local computer group, how do I add my domain users as members of this group?

regards Geir
0
Making Bulk Changes to Active Directory

Watch this video to see how easy it is to make mass changes to Active Directory from an external text file without using complicated scripts.

 
LVL 59

Expert Comment

by:Darius Ghassem
ID: 29928905
This is a local group if you look at the link I provided it will show you how to deploy through a GPO.
0
 
LVL 8

Expert Comment

by:ggefter
ID: 29939613
under users and computers, go to groups and find power users group and just add the domain account of the person you want to assign the rights to
0
 

Author Comment

by:geir056
ID: 29943542
You mean to do this sparately on every local computer?  I need a centralized solution, I will check the GPO solution at work tomorrow.

If I misunderstand your suggestion, please elaborate.

regards

Geir
0
 
LVL 8

Expert Comment

by:ggefter
ID: 30020114
thanks to both of you, ill award the points to the genius ...
0

Featured Post

Creating Active Directory Users from a Text File

If your organization has a need to mass-create AD user accounts, watch this video to see how its done without the need for scripting or other unnecessary complexities.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

OfficeMate Freezes on login or does not load after login credentials are input.
The recent Microsoft changes on update philosophy for Windows pre-10 and their impact on existing WSUS implementations.
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
This tutorial will show how to configure a new Backup Exec 2012 server and move an existing database to that server with the use of the BEUtility. Install Backup Exec 2012 on the new server and apply all of the latest hotfixes and service packs. The…

600 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question