User Install Rights on Terminal Server 1

[MichaelCullen]

Hi

I have a new domain with a win 2K3 server with Terminal Server active on it

all my users log into it and can get access to the locally installed programs i.e. Office, IE7 etc etc...

however I have a group of sales people that access variuos supplier web sites and they have tools on these sites that they need to run, now the tools need to install active x and run java scripts but they also need to install there own bits of software.

I at the moment just have the default GPO and with that my users can install and run activx and can install any 3rd party apps

what I want to set for my users via a GPO is the ability to setup applications aand run and install active x stuff with out the need to give them administrator rights.

I have also tried running all the setups under the administrator account but the settings and programs have transfered accross to all users

any ideas

thanks

 

[gmail2]

OK, I'm slightly confused ... you're saying that everyone can install applications at the moment? So obviously they have local admin rights then? Basically, you want only your sales users to be able to install applications, but without your other (non-sales users) being able to access these, and without giving any of your users local admin rights?

I presume you want to do this to lower the amount of time you spend administering the server, so that users can escentially "manage" it (or at least the applications) themselves?

I don't think you can achieve all of what you want to do here

1. Sales users ability to install applications:
I don't think you can do this without giving them local admin rights. The closest you could come to this would be to either publish applications for your sales users. But this would require more administration on your behalf, and obviously would only work for msi files.

2. Only allow sales users to access the "sales" applications:
Again, I don't think you can do this without some administration by yourself, or another IT administrator. You could control this by using software restriction policies, or file permissions. Maybe if you created a folder on another drive (eg D: or E: drive) called Program Files and tell your sales users to install their applications there, then you could set the permissions on that with GPO so that only sales users and administrators can access it. However, if there are any shortcuts in the All Users Desktop pointing to any of these files, they won't display correctly for non-sales users.

Don't want to start questioning your policies or anything, but maybe it's time to take a step back here. What kinds of apps are these websites trying to install? If they're Java applets then using Sun Java should get around this. Microsoft Java will install these to C:\WINDOWS\Downloaded Program Files but Sun Java will install them to the user's profile folder (something like C:\Documents and Settings\USERNAME\Application Data\Sun\Java\...etc...). Are you sure you want users installing any app they fancy? We've given our roaming users local admin rights on their laptops and most of them have ended up with virus or malware on there and also installed any application they saw fit ... without worrying about licenses etc.

I don't think I've really given you a solution to your initial question (but I don't think you can either) but hopefully I might have pointed you in the right direction, or at least given you some food for thought. If you post back some more details on what apps the users need, maybe we can help further.

Good Luck !!

Irish Poetry - Karen O'Connor
Irish Poetry and Short Stories - Doghouse Books
Garten und Landschaftsbau

 

[MichaelCullen]

Hi

sorry about that, but yes all I wanted to know was could I give users the rights to install appliccations on a terminal server without giving them admin rights

but thanks for the reply as it gives me the answer that I need.

I'm just going to have to give them admin rights, install the software and then remove the rights

thanks again

Michael