Windows 7 Pro STANDALONE: allow user group to install application

[mdfx]

Hi,

i need to do the following on a STANDALONE (no domain) W7Pro machine:

- create admin user --> easy
- create standard user group --> easy
- create a sort of "tech" user group: the users belonging to this group need to install applications without being prompted for admin password.

I've been told that this is possible with GPO, but so far I was not able to identify a local policy or o group of local policies that do the trick.

Can you help me, please :banghead: ?

 

[cyanna]

Create the "tech" accoutns and add them to the "power user" group. They will still need to provide a user name but it can be their own rather than the administrator one.
This being said all it takes is a user who knows how to use a computer to work around all of this, not to mention that a lot of software doesn't need the classical installation methods. For example Chrome offers a "non admin" install if it notices UAC is asking for a password, portable apps are rife and what I use at work so I can have a command prompt, shadow explorer and other goodies otherwise disabled by GPO...

 

[mdfx]

Thanks cyanna,

power user group is not working for us. We tested and many setups have problems (e.g. cannot access to registry) and abort the installation.

We really need full install privileges for the "Tech" group.
PCs will be positioned in a place where non technical people (standard users) will use few applications.
New applications shall be installed by "tech group" users, but they cannot be administrators due to company policy (even if PCs are not in the domain).

Any other idea ?

 

[cyanna]

If you want a group of users to have full access to the registry and services that is by definition an administrator. (A GPO would essentially give users local admin rights)

 

[mdfx]

What about starting from an admin user type and then removing the capability to add/remove/edit user and groups.

Can this be done via GPO ?

 

[cyanna]

Not really, but you can prevent acces to the control panel for a particular user, including an admin, via editing the registry. You will need to be logged into their accoutn to do that. Because they are admin they can reverse the edit, but I believe you don't think your users will have that kind of knowledge? (a dangerous assumption IMHO).
You can do the same thing to hide the console from them (cmd.exe), with the same caveats.