Allow domain user to install software on machine

Hi,

We have a web designer who needs to be able to install software and updates on her own machine. She is an admin on the machine and we thought adding her to the power users group would do the trick but it didn't help. The box is Server 2003 and the machine is w7.

What can we do to resolve this without giving her full admin rights?

Thanks.
sio2yAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Will SzymkowskiSenior Solution ArchitectCommented:
You cannot install software on a machine if you are not an administrator. There is 3rd software out there that extends your Group Policy which can allow for Whitelisting of specific applications.

A product that I have used is Desktop Authority or Privilege Authority.
http://privilegeforum.scriptlogic.com/Forum/aff/1/aft/228/afv/topic.aspx

Without that you will not be able to do something like this natively.

Will.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
McKnifeCommented:
lt should not be left out that non-admins may indeed install gpo assigned msi packages on demand.
0
arnoldCommented:
On a server oS, the user has to be a member of local administrator or possibly a server operator group member.
A web designer does not need as a normal scheme install any software, presumably you mean the person needs rights for IIS to register items possibly adding DLLs/applications.
0
Creating Active Directory Users from a Text File

If your organization has a need to mass-create AD user accounts, watch this video to see how its done without the need for scripting or other unnecessary complexities.

More Information
McKnifeCommented:
A sensible workaround would be to make her a standard user and give her an additional admin password for installations. Then have her sign to use that account only for that purpose, and, if you like to be really strict, monitor the usage of that account by using auditing.

Solutions like what Will has linked or what powerbroker by beyondtrust offers, are administrative overkill for one user in my opinion and costly.
0
Will SzymkowskiSenior Solution ArchitectCommented:
There are ALWAYS other things the user can do like provide the user with another account that has admin privledges, or event just give the users account admin rights on the server etc...

however based on what the user is trying to accomplish cannot be done natively and requires 3rd party software to accomplish this.

Comes down to a business decision as to what they want to do. Cost/Trust.

Will.
0
sio2yAuthor Commented:
Both great options. We will demo the free version of Will's solution and if it works easily $28 would be fine. Otherwise McKnife is correct, one user with a separate login would be ok.

Thanks to both!
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Active Directory

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.