Limit Local Admin Rights

Most of my windows users have the local admin access in order to properly run two major/custom applications.
This means they can also download/install other programs (including viruses) and make changes to many things.

I want to know if it is possible to limit admin access using windows or some other application?

Thanks, your help is much appreciated.
cP6uHIT ManagerAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

JohnBusiness Consultant (Owner)Commented:
Administrators have the keys to the kingdom and uninformed administrators wreck computers.

RULE 1. No user is administrator .
RULE 2. ALL users have UAC turned on.

Not much else you can do with Windows.

You can implement Power Broker for Windows from Beyond Trust. That provides the granular approach you want, but is an add-on product to Windows and your server.

http://www.beyondtrust.com/PowerBroker-Desktops-Windows-Edition.aspx?section=PowerBroker-Desktops-Windows-Edition
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
dlb6597Commented:
I've been able to get many apps working by using process monitor from sysinternals/microsoft. It records all file and registry access and lets you filter on access denied. I launch process monitor, setup filters on the specific app and look for access denied in the log...then grant the appropriate permissions to those registry keys and or file locations to allow the applications to run without local admin privileges. It takes some time, but it is worth it in the end.
0
McKnifeCommented:
If security matters to you, avoid software that requires admin accounts.
John's advice, powerbroker desktop, is capable of doing what you require, empowering standard users to use selected applications with higher privileges securely - windows alone is not.
0
cP6uHIT ManagerAuthor Commented:
I will adjust the UAC settings on each workstation, and get a quote for Power Broker from Beyond Trust.
Thank you.
0
JohnBusiness Consultant (Owner)Commented:
@cP6uH  - Thanks for the update and you are very welcome.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows 7

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.