How to support locked down users

[lv2wrench]

So I have a good question for ya.
We are deploying Win7 with App Locker, Bit Locker and a ful range of security. Also Domain Users will not be in Local Admins. Thus when users call in to support and we have to walk them through the process, they will not have rights to access most management consoles.They will not have rigts toMy Computer > Properties> Manage. They will get You do Not Have Permissions to do this.
No checking Wireless settings, starting a Defrag, or most troubleshooting tools.

SOo......... Does any body have any ideas or best pratices. I'm for a local account with a secure PWD that resets. A tool that can elevate users for a session. I'm most worried about users calling in that cant get on the internet so we cant remote in.

Help A Brother Out Here

How Sweet It Is

Thanks in Advance

Dave C

 

[cluberti]

Well, when users aren't admins, they then need to be supported by users who have the necessary rights and permissions to carry out that support. It might make sense to create a domain group that contains the support folks, and use group policy restricted groups to add that group to the local administrators group on the local machines. That way, any remote assistance sessions with a help desk or field technician will allow that technician to use their credentials to do the administrative tasks necessary. If your users don't have internet access, then they can use the troubleshooters in the control panel or from the Action Center to try and fix it - no admin perms necessary. This particular edge scenario should not be a problem in Windows 7.