Hey everyone! I'm new to working with domain controllers and Group Policy Objects (GPOs). I'm looking for advice on how to allow some users—specifically, a few managers in the technical department—to install, update, and uninstall their own software without giving them full admin rights. Any insights on how I might elevate their privileges in a limited way?
5 Answers
If you have SCCM or Intune in your setup, that's a good route to go! You can publish software to users through the Software Center or Company Portal, so they can install it whenever they need.
Consider using LAPS. You can provide users with the admin account password, which changes regularly. Alternatively, you could create separate admin accounts for them, which I’ve done for development teams before.
Like others mentioned, using Software Center is a solid solution. There are also paid elevation management tools that can simplify giving users install permissions.
If you're running an on-prem setup, check out PDQ Inventory and Deploy. You can create software packages and push them directly to the users' machines, which might solve the problem.
Unfortunately, it's tricky. Users typically need full admin rights to install software through GPO or local user settings. Even though the Power Users group exists, it really doesn’t provide the necessary permissions anymore. One option is to set up a service admin account with limited scope on certain machines. Users could then elevate their permissions through UAC to install software, but this should be tightly controlled with good policies in place.
True, while it's not ideal, having that kind of control can work if you monitor it properly.
Yeah, LAPS is great if you're low on budget and time for comprehensive solutions. If it’s just a handful of users, individual local admin accounts can be manageable too.