How To forum


Active directory account

by amacen87 / October 5, 2017 8:19 PM PDT

We are trying to create an account in Active Directory that does not have login privileges, but DOES have rights to install programs when a user is logged in. Is this possible?
Trying to set up an account for a student help desk at a school, and we do not want to give too much access, but ability to install programs and update drivers.

Answer This Ask For Clarification
Discussion is locked
You are posting a reply to: Active directory account
The posting of advertisements, profanity, or personal attacks is prohibited. Please refer to our CNET Forums policies for details. All submitted content is subject to our Terms of Use.
Track this discussion and email me when there are updates

If you're asking for technical help, please be sure to include all your system info, including operating system, model number, and any other specifics related to the problem. Also please exercise your best judgment when posting in the forums--revealing personal information such as your e-mail address, telephone number, and address is not recommended.

You are reporting the following post: Active directory account
This post has been flagged and will be reviewed by our staff. Thank you for helping us maintain CNET's great community.
Sorry, there was a problem flagging this post. Please try again now or at a later time.
If you believe this post is offensive or violates the CNET Forums' Usage policies, you can report it below (this will not automatically remove the post). Once reported, our moderators will be notified and the post will be reviewed.

All Answers

Collapse -
Conflicting requirement.
by R. Proffitt Forum moderator / October 5, 2017 8:37 PM PDT

You state no login then tell about a login. That's not clear. As rights go, install rights pretty much give away the keys to the PC's kingdom so I don't see how this could be considered secure.

Collapse -
Hopefully more clear
by amacen87 / October 5, 2017 8:48 PM PDT

I understand, and I am sorry it wasn't more clear.
Everyone at the school has an account in AD. We set up a Student help desk to be able to take some pressure off our small department. We are trying to brainstorm a way to be able to do this:
When the person who is logged into the computer is trying to install a program, a security warning pops up asking for admin rights. We are looking for an account to use for this specific purpose, but not be able to log into the computer it self, just elevate privileges when in use.
Does that make more sense? Like I said, we are trying to brainstorm ideas, so any help would be greatly appreciated.
Thank you!!

Collapse -
This is how security is breached.
by R. Proffitt Forum moderator / October 5, 2017 10:06 PM PDT
In reply to: Hopefully more clear

The rootkit or ransomware would have a clear path into the PC. The number of times they need to install should drop fast after the first week. And again, you must maintain control.

Post was last edited on October 5, 2017 10:07 PM PDT

Popular Forums
Computer Newbies 10,686 discussions
Computer Help 54,365 discussions
Laptops 21,181 discussions
Networking & Wireless 16,313 discussions
Phones 17,137 discussions
Security 31,287 discussions
TVs & Home Theaters 22,101 discussions
Windows 7 8,164 discussions
Windows 10 2,657 discussions

Does BMW or Volvo do it best?

Pint-size luxury and funky style

Shopping for a new car this weekend? See how the BMW X2 stacks up against the Volvo XC40 in our side-by-side comparison.