1

this is my first post here so i hope i won't do mistakes going OOT.

I manage a local network running a WinSrv 2012 as DC.

I have my gpo setted having 2 main groups, employees and superusers. The employees have just regular privileges, the super users have almost admin privileges.

I need a regular user to be able to run a java file that require Admin rights to be opened.

Which is the right way to do? allowing him to be a local computer admin, setting somethig in the group policy?

AntoServer
  • 11
  • 1
  • This question pops up from time to time and the answer is: it depends on what exactly you want to do. Can it be done with a service account at all? Because there is no way I have heard of that a user can be administrator for certain programs. Either you are local admin or not. But if you can somehow have a service user with local admin privileges do it, you can get around that. – mzhaase Sep 16 '16 at 11:10

1 Answers1

-2

When the user is created by the dc then you cant give him the local administrator permissions, because he is on the dc and not on the local computer/server u must give him the admin priviliges on the dc.

P to B
  • 1
  • 1
  • Sorry but this is incorrect. You can give accounts local administrator privileges on domain computers, even if they are not administrators on the DC. This is even the preferred way to handle administrative accounts: you don't want to work with domain admin (DA) privileges on regular computers, so you just use a GPO to give admin users local admin rights on every machine, instead of making them DA. Then have seperate DA accounts. – mzhaase Sep 16 '16 at 11:08