I have an intern that I want to be able to install software on computers through the network and join them to the network. I have found the option for adding computers to domain, but what permissions do I give them so that they can install software. I really don't want to make them an administrator. Thanks.
2007-03-12 05:30:35 · 4 answers · asked by Chris 2 in Computers & Internet ➔ Computer Networking
Basically I want to make sure they don't touch my servers.
2007-03-12 06:09:23 · update #1
Create a new security group and place the user in this group. That way, as users change, you don't have to re-do all the permissions.
Once the security group is set up, set the permissions to it through group policy. Give them the right to join workstations to the domain, of course. Also, make them administrators of all local machines (not a domain administrator). This can be done through group policy, or computer by computer. This gives them the right to install software on all systems except the domain controller. It will also give them an account to modify/troubleshoot all issues on workstations, without domain admin permissions. If software needs to be installed on the DC, do it yourself. You might consider giving him permission to add/remove/modify domain user accounts as well, so he can deal with adding/deleting users, lost password issues, etc.
As time goes on, you can add or remove permissions as your desires and trust regarding your employee change.
2007-03-12 06:56:35 · answer #1 · answered by antirion 5 · 0⤊ 0⤋
If they have permission to install software, they pretty much have Admin privileges. I believe you can give them "Modify" permissions and it will allow app installation. The only thing this doesn't give them is "Full Control", but there isn't a big difference.
====UPDATE====
OK....the new info you entered gave more info......You can give them admin privileges in active directory for the domain, but on the servers you can create more restrictive "local" privileges. You can do this by setting their user privileges on the server partitions to be lower than the admin privileges and the more restrictive permissions will take effect on those machines. They will still be able to log into workstations and have admin privileges.
2007-03-12 12:43:25 · answer #2 · answered by PDH 4 · 0⤊ 0⤋
Ditto what the other user said. You can create another security group and add the modify group and change the advance settings so that he/she can't modify certain levels. What areas are you trying to keep the person out of?
2007-03-12 12:47:24 · answer #3 · answered by daymnimlost 3 · 0⤊ 0⤋
You are probably going to have to give them Administrator. At the very least NETWORK CONFIGURATION OPERATORS.
2007-03-12 12:46:37 · answer #4 · answered by Kokopelli 6 · 0⤊ 0⤋