I'm managing a situation in our Windows Active Directory where our entire Sales department has local admin rights, but it's only necessary for them to demonstrate one specific application. They need these permissions to show its full functionality to customers during sales calls. However, I want to know how to give their standard user accounts the necessary permissions for this app only, without creating separate admin accounts for each of them.
Currently, they're not domain admins but have a secondary AD account added to the local administrators group on their workstations. I've heard about customizing folder or registry key permissions, but I'm uncertain how to do this correctly. Just to clarify, they only need local admin rights for the initial installation and setup of the app, not for its usage afterward.
1 Answer
You might want to set them up with a virtual environment that resets after each demo. This way, they can have the admin rights they need within a controlled space without affecting their actual machines.
That’s a solid plan! With a virtual setup, you also avoid any lingering issues caused by having admin access on their actual devices.