Can a user be delegated rights to install software without Domain Admin or Local Admin?

Jody Davis
Jody Davis used Ask the Experts™
on
I need a user to be able to install software on their Win7/Win10 laptop. They cannot be a member of Domain Admins or Local Admin on the laptop. Is there a way to give them permissions to do so without making them a member of either group? Membership of those 2 groups are completely off the table. I'm not looking to discuss group policy workarounds to solve this - just wondering if this permission is possible otherwise. Thanks!
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Distinguished Expert 2018
Commented:
To be very clear from the start: let's say, there was such a way. If you could entitle a user to install any software he likes, it would be very easy for users like me to create a specially crafted installer with the only objective to make me admin.

So clearly: no, there is no such way.
What you could do, is to use GPO software deployment which will allow users to install what you offer them to install (published MSI packages) on demand. However, this will not allow users to install anything they like, which seems to be what you have in mind.
Jody DavisSystems Engineer

Author

Commented:
Well said. And i agree - our company is WAY too liberal - but the request was handed to me nonetheless. lol. But good point on the published ms apps through group policy. Thanks man.
Distinguished Expert 2018

Commented:
You are welcome. Learn about the process of publishing installers for on-demand-installation by non-admins: https://www.advancedinstaller.com/user-guide/tutorial-gpo.html ->See 5.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial