User Permissons Server 2008/2003

[ryanak]

I am setting up a new domain for one of my clients. the domain will contain both Windows Server 2008 Standard x64 and a legacy Windows Server 2003 x32 server for non-64bit compatable applications.
This organization has multiple offices. Each office manager has historically had the Administrator username and password in case they need to install an application for one of the users. That wasn't an issue since each office was it's own domain.
I am now setting up this network as one domain, and do not want users to have access to a Domain Administrator account. Is there a security group that I can use that has permission to install applications on a workstation without being a full Domain Administrator (Power User cannot install items that change the registry of that workstation)?

Thank you.

 

[scottew]

Create a new security group and add that group to the workstations as a local administrator.

Scott

 

[acl03]

Scott is correct, this is how to do it.

Some more details on how to do what he said:

1. In AD Users & Computers, create a new security group.
2. Add appropriate AD Users to this group.
3. On the server in question (or connected remotely) go to computer management.
4. Expand Local users & Groups
5. Click Groups.
6. Double-click Administrators
7. Add the AD Group that you created (which contains the users who you want to be administrators on that specific server).

This may be a little more (not much more) tricky if this server is also a domain controller, as by default only Domain Admins can log into it locally. If that is the case, post here and I can help you with the group policy changes that wouldbe necessary.

Thanks,
Andrew

Hard work often pays off over time, but procrastination pays off right now!