0

We are using Microsoft Deployment Toolkit + WDS for computer imaging in our organization. One problem we are trying to solve is how to allow users to install software, preapproved by the IT department, without granting users admin rights. We would like to use freely available (included) software to do this. We have AD, WDS, and MDT, but not SCCM.

One solution we have been using to a limited extent is Group Policy Software Publishing. We can add software as "available" for a user (rather than published), and the user can then install from Control Panel without admin rights. It works well, but the downside is that it only works with programs available with an MSI installer. We need to be able to support common EXE installers as well.

We are also using MDT to deploy Applications as part of the OS install task sequence, and I've been using a custom "Applications" task sequence that can be run within Windows to test that silent installation of programs is working correctly. I got to thinking that perhaps this task sequence could be used as a "poor man's Software Center", so to speak. The main issue is that launching LiteTouch.VBS requires admin rights, so in order to run a task sequence from within Windows, admin rights are required. I have done some research and not found any elegant way to allow this. GPP no longer allows Run As in scheduled tasks, limitations exist with PowerShell SecureString... etc.

What would be the best way to allow users to install applications in the Deployment Share without admin rights?

Another thing I have tried is booting into Windows PE via PXE boot and running the Applications task sequence from there. But, it only works in Windows and doesn't run on WinPE:

LiteTouch is trying to install applications. This cannot be performed in Windows PE. If booting from a USB Flash Disk, please remove all drives before restarting. Otherwise, ensure the hard disk is selected first in the BIOS boot order.

Any suggestions? Has anyone used MDT LiteTouch.vbs as a substitute for Software Center? It really does seem to work well, and we would like to be able to use that as it does the job well, except the tool requires admin rights to run.

InterLinked
  • 146
  • 1
  • 8
  • I think the best bet is to have MDT run as a service (system user execution) as that will allow it to install apps without the user having admin rights (that is how software center and company portal works). FYI, MDT isn't meant to replace the above. It is a really nifty solution though and I like your thinking! – Elliot Huffman Oct 28 '21 at 11:37
  • It might be best to not re-invent the deployment wheel and use the existing software. Just re-package your `EXE`s into `MSI`s using a solution like "https://emcosoftware.com/msi-package-builder/convert-exe-to-msi". This will allow you to use your existing GPO methods but for pretty much all installers. – Elliot Huffman Oct 28 '21 at 12:07
  • @ElliotLabsLLC Thanks! Could you elaborate more on your first suggestion, running as a service? I thought about adding a task or something to run it with system/admin rights, but how does the user actually invoke this? Furthermore, can it be done in a way that is deployable (e.g. Group Policy)? Methods like making a runas are obviously not possible for this reason since they are per user, per PC – InterLinked Oct 28 '21 at 12:45
  • For method one, I don't actually know. It's just an idea that is technically possible, I've never tried it. I would personally go with company portal or software center myself or use the exe to MSI packaging tools. What you're asking for would require a lot of custom code that I'm not prepared to help with. – Elliot Huffman Oct 28 '21 at 17:05
  • 1
    @ElliotLabsLLC Thanks, we are a bit hesitant to try some of the EXE to MSI tools, just due to program integrity concerns, and the one you linked appears to be paid, at which point we may as well dole out the $$$ for Software Center. Apart from $, we already have everything else we need in MDT and don't really need SCCM for any other reason. I'm willing to spend some time writing scripts or some other custom solution, but not sure of the specifics for how a user can invoke. I guess we'll keep trying to figure this part out. – InterLinked Oct 29 '21 at 00:19
  • You might want to try company portal with Endpoint Manager (Intune). Much easier to implement and use. – Elliot Huffman Nov 03 '21 at 14:32

0 Answers0