Re: Domain account - rights to install apps on all workstation in

Thanks.

The GPO has to be assign to an OU that contains all the workstations that
need the local admin, hasn't it?

"Herb Martin" wrote:


"SorinD" <SorinD@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote in message
news:1A850714-CD8A-4F66-A837-9320654A6798@xxxxxxxxxxxxxxxx
Hi,

I have an AD envinorment based on 2003 SP1 DCs (2003 domain and forest
functional role).

I want to create an domain account that has the right to install
applications in all computers that are part of the domain (without adding
this user to the Domain admin group).

Depends o the apps involved. Some require NOTHING special and
some can only be installed by a computer Administrator.

And when you say "all computers" hopefully you mean NON-DCs
and even non-Servers.

For that I figure I have to add this user to the local admin group of all
computers (unless there is another way to do it).


Is there a way to do that - whithout gaoing to each PC and add the domain
account to the local Admin group?

Depends on the apps.


You can use Restricted Groups in a GPO for actually putting a domain
group in the local Administrators groups of the computers.

--
Herb Martin, MCSE, MVP
http://www.LearnQuick.Com
(phone on web site)



.

Relevant Pages

  • Re: Active Directory Folders
    ... >> I'm certainly not going to discount a book published by Microsoft ... >> replace the computers and users containers created by default and ... Passowords can only be set in a GPO at the ... Laptops ...
    (microsoft.public.windows.server.active_directory)
  • Re: GPO Problems
    ... The computer configuration part belongs to computers and the user configuration part to the user, so depending on the settings you must have the accounts located there. ... If rsop.msc or gpresult /v logged on with a user account doesn't give any output there can be additional problems with GPO applying belomging to DNS confgiruration or slow links between sites. ... Only the password policy an account lockout policy have to bet set on ...
    (microsoft.public.windows.server.active_directory)
  • Re: Group policy to apply only to some workstations
    ... Gregg Hill wrote: ... the GPMC and clicked on SBSComputers, and there are no GPOs linked. ... I guess the next question would be "Why do the computers even need ... GPO) settings from applying to select computers? ...
    (microsoft.public.windows.server.sbs)
  • Re: Group policy to apply only to some workstations
    ... Inheritance" tab under SBSComputers, it shows a bunch of linked GPOs. ... settting to only select computers or block some standard SBS (domain GPO) ...
    (microsoft.public.windows.server.sbs)
  • RE: GPO does not apply on 2 computers unless the user is an Admin.....
    ... I understand that 2 of over 50 Windows XP machines cannot apply GPO if the ... logon user is a domain user without local admin privilege. ... Applying Windows XP Group Policy in a Windows 2000 Domain ...
    (microsoft.public.windows.group_policy)