Discussion Locked

XP Power users can't install apps

0 helpful
3 replies
Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
I'm setting up new xp computers and I have added the domain users to the local power group. Most of the time then can install programs but sometimes they get the you need admin rights to install this software and that creates problems. I want them to have access to install any app, but have the power users template. I may be asking too much but it is good that under the power user's template they can't change network settings etc. Any help would be appreciated.

3 replies

by timwalsh

Unfortunately, there are just some apps that require administrator privileges to install properly. For whatever reason, that's how they were written. Sometimes, if you contact the Tech Support people of the application's publisher, they will provide a work around. But this isn't guarenteed.

A possible work-around (we tend to use this in our organization): The RunAs option will allow a user to run a process (i.e. a software installer) with the credentials of an account with elevated privileges. It would work something like this:
1. Create a generic domain account with administrator privileges. Give it a password only you know.
2. When someone needs to do something (like load software) that requires administrator privileges, you can toggle the temporarily change the password on this generic account and give the userID/password to the user. The user can run the software installer using the RunAs option. When the user is done, you can then cahnge the password again to your secret password. This prevents users from using this feature when you don't allow it.
3. Ass an alternative, you could enable and disable this account when needed, instead of changing passwords back and forth.

The end result is that your users can use administrative privileges when they really need them (and you allow it), without making them administrators.

Hope this helps.

by sgt_shultz

what if they had local admin rights? could they login locally, install the finicky program and go from there? might have to search a bit for the shortcut as might go in local profile not 'all users'...just thinking out loud...other way sounds more guaranteed to work plus that way to have to get told what and when people are installing on your network...

by joseph moore

Tim's suggestion is the best one to go with in this. RunAs will take care of this for you. Unfortunately, if your IT folks don't handle the installs, then you will have to release the password for the account the RunAs command will use, and that is not always viable.
But, I don't have any other good ideas here. I run into this same problem. During some installs, portions of the Registry are called to be written to, and only members of the local Administrators group have rights to those pieces. I have tried modifying the security permissions in the REgistry to allow the Power Users groups rights so my power users can do their own installs, but you never get all of the permissions set right. Each install is different, and after you change 10 different places in the Registry, the next install calls the 11th place that you didn't modify.

Good luck

This discussion is closed to new replies.