Suddenly all users can install programs without admin rights

somewhereinafrica
somewhereinafrica used Ask the Experts™
on
I just discovered that standard users on my server 2008 AD network can install programs without having to have the admin username and password.

I am unsure why this is, it was asking for admin credentials earlier last week. I checked the GPO's and nothing has changed or should affect this privilege.

Anyone have any ideas what happened or how i reset it to "demand administrator account to install or make major changes"?
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Jeremy WeisingerSenior Network Consultant / Engineer

Commented:
Can you give an example of what programs they are installing? Can you also look to see what users and groups are listed in the local Administrators group on a client machine? What operating systems are in use?
Check the Domain Administrators Group... make sure users are not listed...or a user group is not listed.

Check the local administrators group on the Pc's... make sure that the user is not listed.
Top Expert 2012
Commented:
Make sure that a GPO is not adding them to the local admin groups. You can add through the Restricted Group Policies in a GPO so check to make sure this policy is not set.
Ensure you’re charging the right price for your IT

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden using our free interactive tool and use it to determine the right price for your IT services. Start calculating Now!

Author

Commented:
@ my username:
They can install java update, flash update, install a whole HP Laserjet setup, and one downloaded some software and installed it (like some video encoder or something).

@ njCOMPUTER
The only 2 entries in domain admin are:
"Administrator" and My own user account
They are not listed ion the local administrator on the machine in question

@dariusg
Since i didn't set this up, no they are not members of anything else than the WSUS that was automatically created by the WSUS install
Top Expert 2012

Commented:
If you remove them from the WSUS can they install? Are they in the Power Users group?

Author

Commented:
@dariusg

You know I was thinking about that...

When i installed the WSUS on the server it created a "WSUS" policy that I have added all the workstations to. Should I not have dome this? ...and would that really give any of the local users free install rights?
Top Expert 2012
Commented:
I don't know if it actual did give the users rights but a test lets see if it did since this the only thing you have changed, right?

Author

Commented:
well, i did play with some other GPO's i created, but i deleted and unlinked them. I guess that's the only thing... I will test tomorrow, thanks.

Author

Commented:
it wasn't the WSUS at all, it murt have been that they also existed under the machine with same logon credentials as on the server. I will delete the local users on the machines and that takes care of it. Thanks for your help...

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial