Re: best way to install apps when logged in user is domain user only

From: Oli Restorick [MVP] (oli_at_mvps.org)
Date: 01/22/05


Date: Sat, 22 Jan 2005 00:25:03 -0000

Hi there

If you're using Active Directory, it's preferable to use Group Policy
computer startup scripts (which run in the context of the machine and hence
have rights to install software), or using the features of Group Policy to
assign MSI files.

Anyway, if you really want to use a user login script to install software to
a machine, take a look at the "cpau" utility from fellow MVP Joe Richards.

http://www.joeware.net/win/free/tools/cpau.htm

It allows the "encryption" of the credentials so that a user cannot easily
get the password. As Joe says on the web page above, it's not strong
encryption -- just obfuscation. If someone *really* wants the password,
they can get it, but unless you're really following best practices in terms
of security, there are probably much easier ways for your users to hack your
network.

Hope this helps

Oli

"TJ" <TJ@discussions.microsoft.com> wrote in message
news:0F4003F1-47ED-41AA-9A86-2E742136B76A@microsoft.com...
>I need assistance on the best way to give a regualr admin rights to install
> small patches or fixes of programs that we use. I am familiar with the
> run
> as command. Is there a way to create a batch file to execuate a program
> as
> an admin? And is it possible to include the admin password in the batc
> file
> so that the regulaer user does not need to know the password?
> If there is a better way aside from purchase 3rd party software (unless
> its
> a freebie, of course) please let me know.



Relevant Pages

  • RE: Critical: Group policy overwrote ...all users My documents on
    ... rights only), a system file with only Admin rights. ... > creation of the directory on first redirection permission it ... >> After the initial setup I instituted group policy on the server to redirect ...
    (microsoft.public.windows.server.active_directory)
  • Re: AD tools not functioning
    ... I have set myself with Domain admin, ... rights and assigned the Group policy owner right. ... >> try to edit a group policy, ...
    (microsoft.public.win2000.active_directory)
  • Re: cluster service account
    ... Do you have any Group Policy Objectapplying to the computer? ... account needs 6 rights (outlined here ... > admin group), i tried to give the Service Account admin rights as well, ...
    (microsoft.public.windows.server.clustering)
  • Re: OU level
    ... Location of the domain users group has no bearing on what rights it bestows. ... > the group policy running under the entire domain). ... > group policy but not include admin and domain admins. ...
    (microsoft.public.win2000.active_directory)
  • Re: Lock out Group Policy Editor.
    ... Admin" rights, because by design, they have total access to the domain ... Open the GPMC, select the Group Policy ... Under the Group Policy Objects container are all the policies in the ... pane to modify permissions for any specific policy. ...
    (microsoft.public.windows.group_policy)