Local administrator

Ish · 12 Jun 2010 at 18:59

Hi

Our SBS 2003 security policies don't allow people to install any software on a desktop etc.

I want one dektop to allow any user which uses it to be able to install software etc.

Basically I want any user to have admin rights on a specific desktop.

How do I do this?

Coldzero · 12 Jun 2010 at 19:04

Put that PC in a different OU?

Ish · 12 Jun 2010 at 19:27

The one pc used to have the facility before but since it had a Windows reinstall the facility is gone.

I think it was done using a local admin account?

brainchylde · 12 Jun 2010 at 19:29

Add "authenticated users" to the local administrator group.

Xez · 12 Jun 2010 at 21:41

brainchylde said:
Add "authenticated users" to the local administrator group.

Probably most simple way. If it was a group of computers it'd be worth making a different OU with a set GPO.

Ish · 13 Jun 2010 at 01:08

brainchylde said:
Add "authenticated users" to the local administrator group.

That's done the trick. Thanks.

n3vrmind · 13 Jun 2010 at 17:47

Hmm im not sure id go for authenticated users. This gives anyone credentials on your domain or trusted domains full rights even when they are connecting to it over the network.

If you want everyone to have administrator rights when they are logged in locally to the machine you could add 'interactive' to the administrators group, that means those rights only apply to the person sat at the machine

theheyes · 13 Jun 2010 at 17:55

If you have a list of known domain users just add them to the local administrators group on that PC. The problem with this is they will be running as local admin all the time.

Alternatively you could create a local admin account on the machine that they can log into to perform installs, and then log out and log back into their domain account.

Xez · 13 Jun 2010 at 20:36

theheyes said:
If you have a list of known domain users just add them to the local administrators group on that PC. The problem with this is they will be running as local admin all the time.

Alternatively you could create a local admin account on the machine that they can log into to perform installs, and then log out and log back into their domain account.

Not exactly a tidy way adding each individual user in. Would make it harder to manage depending on the size and amount of users of course.