Solved Restrict Administrator account to install only (Server 2008)

[pilau]

Hi, I need to provide a client a means to install software on the computer, but I don't want the client to be able to change any system settings. It is a Server 2008 system. I know This is a Win7 forum, but the systems are from the same generation.

Is there a way to accomplish this?
Also, sorry if this is the wrong forum, mods can fix. Thank you in advance!

 

[logicearth]

Can you install administrator applications that require administrative power to be installed....No...unless you get the developer of those applications to change them. Even if you could, that would be a security risk. A non-administrator user could use the administrative-powered application to conduct administrative tasks. Not good.

 

[pilau]

Thanks for the quick reply! However, I think you may have misunderstood me.

Allow me to elaborate:
The client logs on to the computer through remote desktop on a standard user account - not an administrator account. I have set up an additional administrator account ("admin") without the ability to log on through remote desktop i.e. - even if I give the client the admin password - he cannot log on to this account from RDP.

I want to limit the admin account to only be able to install software - and that's it.

 

[logicearth]

Right...but its already setup like that. Only an administrator privileged user can run and install software that affects the system as a whole. A user that has no administrative power can only affect themselves, deleting their user created directories clears everything away. There is nothing to configure.

 

[pilau]

I'm sorry mate, but you still don't understand

I set up another admin account. This account cannot log in via remote desktop. I want to give the client, who logs in via remote desktop, the admin password, so he can install programs. However, because I am giving him the password he can basically change system settings and so on - and I want to restrict that admin user from doing. I want it to only be to install programs and that's it.

Please help me achieve this. Thank you in advance.

 

[logicearth]

.............Course I don't understand you keep leaving important information out!

You given the user an administrator account, with administrator power now you want to revoke their administrator power except the ability to install applications, correct? You might as well forget about all of that. You cannot lock down an administrator account that the user can not bypass. Its like installing the worlds best security system in your house...yet you leave the key to the front door and the secret security code on the front porch. See how effective that security system is now.

You cannot give a user administrative power and take it away except one item, it does not work like that. Their is no "allow installations for non-admin users" because the concept of installing software is just an abstraction of copying files into certain locations which may or may not need administrative power to write to those locations. Allowing non-admin users to write to those locations is not wise. Thus, it cannot be done. (In a secure fashion)

 

[pilau]

Yes, I understand now. Thank you