What kind of rights that can be given to a user?

Question

Hi everybody

When we create a new user in AD, by default, it has only user rights. One of the consequence is that they cannot have the rights to install new software. I was wondering how I could modify temporarily the rights that a user have so that he can install software. GPO should not be used in that process since they do not work well through the VPN.

Thank you

Answer 1

HI @Frédéric Giguère ,

If you don't want to use Group Policies (GPO), then you could simply give the users temporary local administrator rights on their computer, and once the users are done with the installations, remove the local administrator rights, this can also be automated with scripts.

Similar discussion over here:
https://community.spiceworks.com/topic/99721-temporary-right-to-install-software

----------

(If the reply was helpful please don't forget to upvote or accept as answer, thank you)

Best regards,
Leon

Answer 2

Thanks for the reply @Leon Laude .

How can I provide temporary local admin rights to specific users without using GPO's? The thread that's been submitted talks of using GPO.

Best regards
Fred

Answer 3

OK got it thanks

It is really useful indeed but is there a way to use powershell to specify that an AD account have admin rights?

That thread does not show that.

Answer 4

My need is to have one single AD account with local admin rights.

The reason is that we want our users to install Office 365 on their computer and it requires local admin authentication.

I've created a GPO to do that but I found out that VPN and GPO do not work well together. Because of the COVID we have now a lot of employees that works from home.

So let's say that I need only one AD account called Office365. How can I easily give him the rights to be local admin without go as far as domain admin? Is there a way to do that without having to learn powershell? That would be really nice.

Thanks

Answer 5

Hello @Frédéric Giguère ,

Thank you so much for posting here.

As far as I understand, we could do it on the PC locally. Sign in as local admin or domain admin and search lusrmgr.msc.
Open Local Users and Groups

Choose Groups

Choose administrators

Add the user there

Hope the information is helpful. For any question, please feel free to contact us.

Best regards,
Hannah Xiong

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.