user account privilege !!!!

[hdamis]

Hello,
I created users in active directory but the question is how to give the users accounts a privilege to install a programes ....!
Thanks.

 

[bofhrevenge2]

If you just want them to add programs to their own PC's then add their domain account to the local administrators group.

 

[hdamis]

Ok you are right!
but if you have more than 1000 users what will you do ?

 

[bofhrevenge2]

We have 1800 users and find the restricted groups feature of 2003 Active Directory very usefull for this.

http://www.microsoft.com/resources/.../all/techref/en-us/W2K3TR_sepol_00004_set.asp

"Horsey to king bish three

 

[hdamis]

Thanks, for reply !
I try to do Restricted groups but the groups which I made will be member of what ? I need to allow this group to install a program no thing else ...
if they will be member of administrator they will be do every thing and it is not good .

 

[bofhrevenge2]

Hmm yes true but if they can install programs then they can pretty much get away with anything anyway.

They will only be admins on the local workstation not the domain, alternatively you could make them power users but they can't install all programs.

"Horsey to king bish three

 

[hdamis]

thanks any way .
I will think how to do it in other way .

 

[bofhrevenge2]

Ok there are some pretty good guys in the Win2k/xp forums i'd ask there.

"Horsey to king bish three

 

[bofhrevenge2]

Having said that i don't let my users install software i use MSI's and group policy to install all our software.

"Horsey to king bish three

 

[mlichstein]

Making users administrators of their machines is a very bad idea. It's a great way to spread malware and cause general mayhem with your network.

Your network should operate under the rule of least privilege. Users should have only the permissions that they need to do their work. General users should have absolutely no need to install applications. That's what the administrators are for.

 

[bofhrevenge2]

Oh yes i agree with you mlichstein my users are all restricted users and cannot install anything, i was just providing an answer to the question.
We did have a room where users we're power users and the amount of IE toolbars and spyware that appeared was ridiculous, almost all of these fail to install if the users are restricted users.

"Horsey to king bish three