Solved

Permissions to install software on Domain Computers

Posted on 2011-03-14
8
1,254 Views
Last Modified: 2012-05-11
I am looking to grant our Helpdesk team enough permissions on domain computers to install software.  Currently they need to have a Domain Admin enter credentials.  Is there an AD group I can add them to that will allow us to grant this permission without giving them too much or do I need to start adding the helpdesk group to power users on the workstations?
0
Comment
Question by:purplecables
8 Comments
 
LVL 6

Expert Comment

by:brb6708
ID: 35130949
Just give them domain admin rights  and take away rights for domain admins from shares / files that you won't them to be able to access

0
 

Author Comment

by:purplecables
ID: 35130963
That is not an option.  We do not want them RDP'ing into servers or doing all of the other things Domain Admins do.  I'm pretty sure best practices is not to just give Helpdesk employees Domain Admin rights.
0
 
LVL 4

Expert Comment

by:CHutchins
ID: 35130985
You can build a GP to add them as local administrators to all PC's, But the Domain admin is th eonly one I know with the needed rights without building a new group.
0
 
LVL 4

Accepted Solution

by:
vnicolae earned 500 total points
ID: 35130994
I would create a domain group called HelpDesk Support  and add it to the local Administrators group of the PCs. Don't give them Domain Admins privileges, that is too much.
0
How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

 
LVL 27

Expert Comment

by:KenMcF
ID: 35131041
You will need to give them domainn admin rights for this. Why are they installing software on a doamin controller anyways?
0
 
LVL 5

Expert Comment

by:NotVeryFat
ID: 35131306
Is an option to simply set the LOCAL admin passwords the same for all PCs (different to servers), which can be done via a script, and then let the Helpdesk guys know just this password. Invariably even 1st line Helpdesk guys need to be trusted with local admin passwords for PCs.
0
 
LVL 4

Expert Comment

by:CHutchins
ID: 35157176
Yes it is possible, but why not just as was mentioned create a group and using GPO add the group as local admins.

Te settings would need to be applied to the Computer Group OU and then the computers settings side of GP.  I just can't remember off the top of my head the exact commands/locations.  It is not a script I used it is a setting.. thought I imagine a script has been made in the past.
0
 

Author Closing Comment

by:purplecables
ID: 35157323
This is an adequate solution
0

Featured Post

Maximize Your Threat Intelligence Reporting

Reporting is one of the most important and least talked about aspects of a world-class threat intelligence program. Here’s how to do it right.

Join & Write a Comment

You might have come across a situation when you have Exchange 2013 server in two different sites (Production and DR). After adding the Database copy in ECP console it displays Database copy status unknown for the DR exchange server. Issue is strange…
Possible fixes for Windows 7 and Windows Server 2008 updating problem. Solutions mentioned are from Microsoft themselves. I started a case with them from our Microsoft Silver Partner option to open a case and get direct support from Microsoft. If s…
This tutorial will walk an individual through configuring a drive on a Windows Server 2008 to perform shadow copies in order to quickly recover deleted files and folders. Click on Start and then select Computer to view the available drives on the se…
This tutorial will show how to configure a single USB drive with a separate folder for each day of the week. This will allow each of the backups to be kept separate preventing the previous day’s backup from being overwritten. The USB drive must be s…

705 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now