Server 2008 R2: Need an idea for domain user permissions issue

Posted on 2014-08-14
Last Modified: 2014-08-29
This is a server 2008 r2 site, all Windows 7 Pro clients. Users do NOT have local admin rights to their client machines. In this particular business, some users get DVDs with video on them that they need to review. The only way to view these videos is by running an executable on the DVD. When they try to do that, they are met with the admin credentials prompt. I need an idea how to allow certain users to run these DVD video executables without giving them local admin rights to the entire machine and without them using the domain admin credentials. Thanks.
Question by:tcianflone
    LVL 6

    Accepted Solution

    I have used  (App Locker) in the past.  It lets you create policies regarding specific applications to run as a normal user  - lets you lock it down, rather than give admin rights to everyone
    LVL 3

    Expert Comment

    by:Sean Fitzpatrick
    Agree w/ Chad, applocker is your best option
    LVL 1

    Expert Comment


    I found the following, may be it will help you:

    I faced the same problem , what i did was:(Windows 7)

    Ran Regedit and navigated to HKU\z\SYSTEM\CurrentControlSet\Control\Class{4D36E965-E325-11CE-BFC1-08002BE10318}

    Right clicked, then click new, then create a new key. Then rename it to Properties. In Properties create two new dwords

        DeviceType Type:reg_dword Value:00000002
        DeviceCharacteristics Type:reg_dword Value:00000100

    Then Uninstall the driver of cd/dvd from Device manager.

    Scan for New Hardware. Boom!! Problem Solved.
    LVL 1

    Author Comment

    Thanks for the AppLocker idea. I reviewed some training videos on this. Can I create an AppLocker rule just for the video related programs I'm having problems with WITHOUT having to create rules for ALL of the software the users typically use? Or do I have to define rules for ALL software for this to work?
    LVL 3

    Assisted Solution

    by:Sean Fitzpatrick
    You should be able to create applocker rules for just for certain software, you should not need to create it for everything.  Everything else would just run with w/e you have as the 'default' rule.
    LVL 1

    Author Closing Comment

    Thanks for the pointer to applocker. I have not had the opportunity to implement it yet, as is often the case with my job. But from what I've read this seems to be the way to do it. Question: Do any of you use applocker to allow things like flash and java auto updates run from a locked down desktop? Seemed like it could be used for something like that as well.

    Featured Post

    Promote certifications in your email signature

    Has your company recently won an award or achieved a certification? They'll no doubt want to show it off. Email signature images used to promote certifications & awards can instantly establish credibility with a recipient and provide you with numerous benefits.

    Join & Write a Comment

    When I went to try to install Office 2007 and Office 2010 ADMX Group Policy administrative templates on my new Windows Server 2008 R2, I couldn't find any straightforward guidance on how to do it.  I muddled my way through it, but I thought I'd shar…
    New Windows 7 Installations take days for Windows-Updates to show up and install. This can easily be fixed. I have finally decided to write an article because this seems to get asked several times a day lately. This Article and the Links apply to…
    This tutorial will give a short introduction and overview of Backup Exec 2012 and how to navigate and perform basic functions. Click on the Backup Exec button in the upper left corner. From here, are global settings for the application such as conne…
    To efficiently enable the rotation of USB drives for backups, storage pools need to be created. This way no matter which USB drive is installed, the backups will successfully write without any administrative intervention. Multiple USB devices need t…

    732 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    23 Experts available now in Live!

    Get 1:1 Help Now