Re: Question for WinInstall customers

From: Bill Stewart (bstewart@iname.no_spam.com)
Date: 07/05/02 

From: "Bill Stewart" <bstewart@iname.no_spam.com>
Date: Fri, 5 Jul 2002 10:52:16 -0600

"Andy" <andrew_taylor_ihatespammcse@yahooihatespam.com> wrote in message
news:ujRxbpvICHA.1916@tkmsftngp09...

> It seems strange to me that the appliation requires Domain Admins membership
> to distribute desktop software. As long as it has the appropriate access on
> the PCs where it will be installing software, I don't understand why it
> should matter what group object is being used. However, from what I'm hearing
> from the vendor, it appears that they are relying on several default
> permissions and rights that are assigned by default to the Domain Admins
> group object.

I agree with you. It seems that all their software needs is to be a member of a
group that is a member of your workstations' Administrators local groups. I
would try creating a global group in your OU that contains accounts that should
be a member of the Administrators group on the workstations, and add the
software's account to that group. The question to ask is, "Why does the account
have to be a member of Domain Admins if it's in the Administrators group on the
workstations?"

Relevant Pages

  • Re: "Edit Users..." Menu Item Disabled in Telephony Management Sna
    ... To make it clear i used account that is member of domain admins and group ... I set up also the account (already member of domain admins and trough this ... Running "tapicfg show" revealed that I had no Active Directory TAPI ...
    (microsoft.public.win32.programmer.tapi)
  • Re: Listing user privileges
    ... So the service works is Domain Admin, running on a member, ... Domain Admins group resolves the issue, and I'm suspecting (but not yet ... confirmed) that being a member of the Administrators group for the domain ... are the privilege differences between those two groups, ...
    (microsoft.public.windows.server.security)
  • Re: Disappear from Domain Admins group every day?
    ... I read a few things about protected groups, but never read about 'local groups only'. ... I created a user on a Windows 2008 R2 domain and added it to the domain admins group. ... Make sure your account isn't member of the protected groups in AD, ...
    (microsoft.public.windows.server.active_directory)
  • Re: Listing user privileges
    ... that Domain Admins (therefore AD controller ... Administrators group) has no advanced privileges on a member server other ...
    (microsoft.public.windows.server.security)
  • Re: Listing user privileges
    ... Administrators group of domain is used only on the DCs. ... Domain Admins is member in Administrators group of each ... Administrators group) has no advanced privileges on a member server other ...
    (microsoft.public.windows.server.security)