Allow users to install software

Posted on 2012-08-29
Last Modified: 2012-09-17
Hi There

I am doing some work in a school on Server 2003. The students are due back and on one of the courses the students are expected be able to download software from a particular sit and install it on their individual machines. This has to be done by the student as part of the course.  I have already suggested that I load everything in advance of the first class starting. But this is a no no.

So I am wondering. Is there a way to add a group to Domain Admins or does it have to be done on a user basis (I will remove them once this section is complete)? Or is there some other easy way to accommodate this requirement? I may need to do this a couple of times in the school year, so the easier that better.
Question by:doey
    LVL 23

    Expert Comment

    by:Nagendra Pratap Singh
    You can add an entire group to domain admins but then the next day some domain admin may remove you from the domain admin group.

    You may use portable applications. Or you can add that group to local admins via group policy.

    BTW if the software have expensive licences then it is better to have a ticketing system to control the number of installations. You can use several tools to install it automatically or manually via remote.

    BTW what happens if they install pirated software?

    Author Comment

    Thanks for the quick reply.

    I know that this is not a very desirable way of approaching this. But I have been told that this is what the students have to do, so I have to work out a simple way of allow this to happen.

    I have had a quick read of the spiceworks link and it looks like it is worth a shot. It's 6.30am here in Dublin and I have been up all night working on a number of different issues. So I won't get a chance to put this in place until lunch time or so.

    Am I over thinking this. Can I setup up one user with privileges the morning of the class, let them all use this user's details when prompted (once download commences) and just before the end of class I can then delete this account?

    Or have I been up too long and should just go to bed and think straight in the morning?

    LVL 23

    Accepted Solution

    Can I setup up one user with privileges the morning of the class, let them all use this user's details when prompted (once download commences) and just before the end of class I can then delete this account?

    This seems to be a good idea. One admin per class and that too for a day is the best compromise.
    LVL 6

    Expert Comment

    why don't you put users in local admin group on client computers?
    LVL 39

    Expert Comment

    by:Krzysztof Pytko
    As it was already told that software installation may be only done by administrators on a computer, I would like to address another path.

    That's not good idea to allow students running administrative privileges on your hardware. Too much repair work for you in case (really possible :) ) of mess in a system.

    Instead granting them local administrator or giving them any special group membership, I would consider using virtual machines on that workstations.

    You can use Microsoft VPC or Virtual Box install initial machine and they would be able to use them with administrative permissions in virtual environment but on host system they still are regular users. There is less work in case that they would broke virtual machine than physical computer :) You can easily restore VM HDD and its settings (when you prepare environment just do a copy for backup).


    Expert Comment

    You could try and compile a script to runas the setup file using a admin credential.I have used a scripting software such as Autoit in the past that would allow normal users to start setup using a certain admin credentials.

    >> Autoit runas function

    Hence the student would download both software and your runas script and execute the script to start the software with admin privilege.

    Best of luck


    Author Comment

    The room in question is running the oldest PCs in the school. They are Dell GX 270's. I will see, later today, if a test machine can handle a VM running on it without it grinding to a halt.

    LVL 5

    Expert Comment

    Hello, you can achieve this task by publishing this software to the required group of users. Here is the link for the same.

    Author Closing Comment


    I was just looking for a quick solution for something that would only take up 5 minutes of a class. So I setup one account with administrator privileges and set the Log On Hours to only allow the first hour of their class and then have the account expire at the end of the day.

    So even if they took down the details, the window of opportunity for abuse was limited. I know it was a chance but there was only a window of about 10 - 15 minutes that they had, and in this time they were supposed to be doing work in the class.

    Anyway, it worked.

    The other solutions were very good but either there was a lot of time and effort for something so small or I would have to hold the software on the server and allow them to install the designated software. The problem here is that the course required them to find the software on the developers website and install it from there.

    Great suggestions

    Featured Post

    What Security Threats Are You Missing?

    Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

    Join & Write a Comment

    As network administrators; we know how hard it is to track user’s login/logout using security event log (BTW it is harder now in windows 2008 because user name is always “N/A” in the grid), and most of us either get 3rd party tools, or just make our…
    Starting in Windows Server 2008, Microsoft introduced the Group Policy Central Store. This automatically replicating location allows IT administrators to have the latest and greatest Group Policy (GP) configuration settings available. Let’s expl…
    This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
    This tutorial will walk an individual through the process of configuring their Windows Server 2012 domain controller to synchronize its time with a trusted, external resource. Use Google, Bing, or other preferred search engine to locate trusted NTP …

    734 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    21 Experts available now in Live!

    Get 1:1 Help Now