0

I would like to grant users using GPO to self manage and install selected software (flash, skype, Java) but not granting users admin rights. I've looked up software restriction policies, is it the right direction?

or are there other alternatives.

I know I can manage installs from AD, software installation, but I not want to be the one pushing and updating from server side.

setup: AD - windows 2008 R2

users - Win XP and win 7

Sean
  • 1
  • 1

1 Answers1

1

The issue is not whether or not you want users to have admin rights, but whether or not the software installer needs/asks for admin rights when run, which it will do if the app being installed makes system changes.

About the only way I can think of coming close to delivering what you want is something like the SCCM application catalogue. And even with that, you'll have to be managing the publication of 'approved' packages for install, I'm afraid.

Rob Moir
  • 31,884
  • 6
  • 58
  • 89
  • 1
    If the package is an MSI, OP should look at the [`ALLUSERS`](http://msdn.microsoft.com/en-us/library/windows/desktop/aa367559(v=vs.85).aspx) property to see if the package supports per-user installations. – jscott Jun 14 '13 at 09:20
  • good point @jscott though I'm pretty sure that Flash and Java, two of the OP's examples, do not. – Rob Moir Jun 14 '13 at 10:41
  • in other words, there is no such option to allow programs from specified publishers to be freely installed within the PCs – Sean Jun 17 '13 at 01:54
  • @sean not really - by definition, if an app changes the way the system works, or applies to all users, then a 'mere' user can't make that choice for other 'mere' users of the machine. It's not quite what you asked for, and implementing it is a pain, but sccm 2012 has worked well for us, allowing users to select and install apps themselves once those apps have been per-approved by an admin. – Rob Moir Jun 17 '13 at 05:04