Administrator privileges to domain users

Raj Kulkarni wrote:...The applications which they use require administrative privileges.Any ideas.Get a better software vendor.Seriously though, all jokes a side, get a better software vendor. If your software vendor is too lazy or incompetent to build software which cannot run with standard user privileges, then it isnot worth using. Inb4, we cannot... blah blah blah. Of cause you can. It is all about making a business case to management why having users running around with local admin rights is not a question of if something goes wrong, but when.Oh look Jonny wants me toplay"Hack my PC" withhim on facebook, oh what is this? I need to install this "update". Sure, why not? Nothing can go wrong right?
Not the answer you were looking for I know, however it is the RIGHT answer.

For the past few months, on some PC's, I am unable to give a domain users administrative privileges on their own PC. The applications which they use require administrative privileges.
What I have done in the past, with no problems, was to add the domain user to the Administrators group on the local PC. Now, I get an error message, stating that the user name or password is incorrect.
I suspect that there may be some corruption in the active directory on our Windows 2008 server. I have also had password synchronization problems where the password doesn't get changed on the server, but only on the local PC.
Any ideas.
This topic first appeared in the Spiceworks Community

Similar Messages

How to run IE with administrator privileges on limited user account?

Hello,
I have a domain user who needs to access a certain web application on the internet using IE and to do so we have to add this website to IE Trusted Sites Zone and also allow Pop-ups, the issue now is that the domain user has a limited account on this PC (Windows
8.1) and changing these settings is not available. I only have (General-Connections-Programs) taps available under IE Internet Options for this user.

web application is not working just like before. Did i miss something?
Not necessarily. Some users have a problem with security packages which are "protecting" their registry. Also, during a beta I discovered that elevation of the Internet Options dialog and trying to do a RIES had resulted in the
Administrator's Profile being nuked, not the one that was being targeted. Perhaps you are seeing a symptom from something like that?
FWIW I would run ProcMon to find out what is going on. It would be best if you had two cases, one which worked and one which was the problem case. Then you could save both traces as .PML files and open them later to compare them in two separate
ProcMon tasks. That way you can just filter coarsely to find a significant divergence in the two traces and then refine your analysis from there. Otherwise, if you don't have a clear hypothesis to test or know exactly what you are looking for you
could try using the Category Is Write filter. That would show changes which were being done in both the Registry and File system.
Good luck
Robert Aldwinckle

Set the value to ' * ' to grant administrative privileges to all users.

Everytime I run autoconfig, this set up is done automatically in workflow adminsitrator.
A * comes in the Workflow Configuration --> Workflow System Administrator
How to change this in xml file so that * doesn't come up and only sysadmin is given this privilege on administration.
EBS 11.5.10.2
Db 11.2.0.2

Vicky1 wrote:
Everytime I run autoconfig, this set up is done automatically in workflow adminsitrator.
A * comes in the Workflow Configuration --> Workflow System Administrator
How to change this in xml file so that * doesn't come up and only sysadmin is given this privilege on administration.
EBS 11.5.10.2
Db 11.2.0.2I do not think you can set the workflow administrator via the application context file and you can only do by following the steps in (How To Reset The Workflow Administrator [ID 413711.1]).
Thanks,
Hussein

Grant Administrator privileges to users

Post Author: mwong
CA Forum: crystalreports.com
Problem Description:
I need to grant Administrator privileges to one of my users. How do I do that? He needs to upload the reports and invite the users to view them.

Post Author: mwong
CA Forum: crystalreports.com
HiAs of Dec 16, 2007, administrator can now grant administrator privileges to other users.We have added a new Administrators group in the users tab. There are 3 scenarios for adding users to the Administrators group:Scenario 1: New user - If the user does not currently exist within
your crystalreports.com account, you can add the new Administrator by clicking
the Administrator user group on the Users tab
and then clicking Add User.
Scenario 2: Existing user added before December 15, 2007 - If the
user is already in your crystalreports.com account and was added before December
15, 2007, send an email to crystalreports.com Support at [email protected]
with the user's email address. Support will notify you when the user is ready to
be upgraded to Administrator status. Once you receive approval, you can then add
the user to the Administrator user group on the
Users tab.
Scenario 3: Existing user added after December 15, 2007 - If the
user is already in your crystalreports.com account and was added after December
15, 2007, as a Member, you can add the new Administrator by
clicking on the Administrator user group on the
Users tab and then clicking Add User. If the
user was added after Dec. 15, 2007 as a Guest, you must follow
the instruction in Scenario 2. After completing either of the three scenario
above, the new Administrator user will now have full rights to add users, upload
or publish reports, and manage your crystalreports.com account. thanks!Michelle Certain criteria must be met for an account to become an Administrator.See ALSO: http://technicalsupport.businessobjects.com/cs/forums/thread/14541.aspx

Full true Administrator Privileges and rights for New User?

I am wondering how to grant full administrator privileges to a newly created user?
Here is the environment:
Windows 2012 Server 64bit
Not part of a domain <WORKGROUP>
Here is the problem:
I created a new user we will call them "SecondaryAdmin", and made them part of "Administrators" group as well as the "Remote Desktop Users" group.
I login through an RDP session as "SecondaryAdmin", I go to a command prompt, and I run IISRESET and it tells me:
"Access denied, you must be an administrator of the remote computer to use this command. Either have your account added to the administrator local group of the remote computer or to the domain administrator global group."
Additionally, I have IE Enhanced Security turned off, but if I open Internet Explorer while logged in as "SecondaryAdmin" it still displays the IE Enhanced Security warnings.
Also, if I try to copy a file to the root "C:\", it gives me "Access denied error" forcing me to continue with elevated administrator privileges.
If I run the command prompt as "administrator" I can do an IISRESET without error.
If I run Internet Explorer as "administrator" I do not get the warnings.
If I run windows explorer as "administrator" I do not get the access denied.
However, I WOULD NOT trust this "SecondaryAdmin" account to install ANYTHING. Even if you ran the install executable as "admin", often times these install files will fire off secondary scripts that wont be fired off as "admin",
which may lead to incomplete or corrupt installs.
This changed from Windows 2008 R2 to Windows 2012.... If I do the same exact thing in Windows 2008, I am able to do all the above things without prompt or error.
So how can I give a new user true, full, elevated, admin privileges without having to run everything as administrator? Some obscure setting in GPO? Some registry setting (already tried LocalAccountTokenFilterPolicy)?
What I have tried:
UAC is OFF
Firewall is OFF
IE Enhanced Security is OFF
Remote Management/Desktop Enabled
User part of Administrators Group and Remote Desktop Group
Used "netplwiz" to verify user is Administrator
Please help!

Hi Chris,
I appreciate your answers, however, this is not what I am looking for.
I want the "SecondaryAdmin" user, who is part of the Local Admininstrator group, to have full Admin access.
I DO NOT want them to have to do anything special, or have any user intervention.
NO yes/no dialog boxes
NO clicking "Run As Admininstrator"
NO changing shortcuts or executable file properties to always "Run as Admin"
I simply want the "SecondaryAdmin" account, which is part of the "Administrators" group, to have the same access and run the same seamless way it did in 2008 R2, with no user intervention required.
This is what I am looking for.
Kind Regards,
James

Members of domain groups with administrative privileges no longer admins?

Have a strange behavior that I am not sure how to fix.
Using OS X 10.6.7 native Active Directory client to bind to domain. I have directory utility configured to allow administration for a domain group. At first things worked great and members of those domain groups were indeed admins on the machine however the next day one of these users logs in and they are no longer admins. If you run directory utility again using a local admin account you can see that those domain groups are still configured to allow administration but none of those users show as being admins. Then suddenly, as if I did anything, those users show as being admins again. Why? I don't understand how this can flip back and forth like that.

Was this ever solved?? We have the same issue with 10.8.3. It seems a network connection to your AD servers is required when logging in. Otherwise the check cannot be made and the user never receives admin rights. A huge problem for users with laptops that work offline.

Find out who has given local administrator rights to standard domain user?

In my Organization i have faced problems with domain administrator, it seem that all of a sudden a standard domain user is having Local administrator rights. Can anyone please help me how to find out who has given local administrator rights to that standard
domain user account?

Hi,
Based on your requirement, you need to enable the auditing in your Active Directory to identify the user/ group changes and WHO made the change etc.
Checkout the below steps to enable auditing for AD User Changes,
1. Open GPMC console, click Start --> Administrative Tools --> Group Policy Management.
2. Right click the Default Domain Controllers Policy, and then click Edit.
3. Navigate to Audit Policy node, “Computer Configuration/ Policies/ Windows Settings/ Security Settings/ Local Policies/ Audit Policy”.
4. Now enable the Success auditing for - Audit Account Management and Audit Directory Service Access.
5. Execute the command “GPUPDATE /FORCE” in the Domain Controller to force apply the GPO settings.
For Windows Server 2008 R2 and later versions, additional configuration is required in “Advanced Audit Policy Configuration” section in Default Domain Controller Policy.
1. Go to the node DS Access (Computer Configuration/Policies/Windows Settings/Security Settings/Advanced Audit Policy Configuration/Audit Policies/DS Access.)
Enable Success auditing for the following settings
- Audit Directory Service Changes
2. Go to the node Account Management (Computer Configuration/Policies/Windows Settings/Security Settings/Advanced Audit Policy Configuration/Audit Policies/Account Management.)
Enable Success auditing for the following settings
- Audit User Account Management
After completing the audit settings, configure SACL in Active Directory Users and Computers console for enabling the geneartion of AD Change events in the eventlog as shown below,
Checkout the below KB article on complete list on Event ID and Description for AD Changes,
http://support.microsoft.com/kb/947226/en-us
Regards,
Gopi
JiJi Technologies

Active Sync does not start as domain user with no Administrator rights.

Hi all,
Searched the forums and the net but can't find anything about this.
Situation:
In a domain where users only have standard users rights I installed on a PC as a domain admin Active Sync 4.5
When I logon as a user the Active Sync software can not be started.
I disabled the firewall and even set full rights permission on the Active Sync directory both didn't help out.
When I m logged on as this user I can choose to Start the program as a different user.
This only works when I Start it with the domain administrator account.
I hope that I do not have to give that information to this user to make this software work.....
Anyone had the same problems? Anyone a idea?
Thx in advance.
Kind regards,
Aartjan

try this:
1. make sure you install "activesync" from local harddisk (not from network), and do not delete the setup file after
installation
2. local in as "local administrator" and connect your PDA and make sure it can sync, I did not create a profile and just leave PDA connect as "guest" for now
3. log off and re-login as "domain user", connect with USB should work
4. if they still cannot communicate, run "ActiveSync" from start menu
it works for me

How can IT departments set up basic users to run Captivate with Administrator privileges?

As we all know, on WinVista and Win7 or later systems Adobe Captivate must be launched with Run As Administrator privileges in order to function correctly and not crash. But the problem here is that in many corporate environments general users are not allowed to have Administrator access to their own work PCs. This presents something of a dilemma for IT departments with Adobe Captivate users.
Some time ago on this forum one of the Adobe technical staff chimed in on a thread about the Run As Administrator command and explained the technical steps required to set up a Group Policy in WinVista/Win7 that would allow a basic user to always launch Captivate with the necessary admin privileges even though they did NOT have Administrator access to any other app on their PC.
I have searched in vain to find that particular thread and post, so I've started this thread in the hope that someone at Adobe can again chime in to detail the necessary steps again.
So is there anyone there that can help out?

DOH! my bad.....I/we run WinXP at present and no UAC.
However, all may not be lost, try some of these options as posted on teh MS Technet forums....An admin person may need t do this first to enable this for that user...
Apologies for misundeerstand situation. ;-( hate it when that happens!
Try these two options:
Using Compatibility Mode
NOTE: This will allow you to always have the program run as an administrator when you open it.
1. Right click on the program shortcut or program .exe file, then click on Properties, and on the Compatibility tab. (See screenshots below)
NOTE: If you are doing this while logged on as a standard user instead of an administrator, then you will need to also click on the Change settings for all users button and type in the administrator's password.
http://www.sevenforums.com/attachments/tutorials/12832d1243933304-run-administrator-compat ibility_mode1.jpghttp://www.sevenforums.com/attachments/tutorials/12832d1243933304-run-administrator-compat ibility_mode1.jpghttp://www.sevenforums.com/attachments/tutorials/12832d1243933304-run-administrator-compat ibility_mode1.jpgUAC, then click on Yes to apply permission to allow the program to run with full permission as an administrator.
2. To Always Run this Program as an Administrator
A) Check the Run this program as an administrator box, and click on OK. (See screenshots above)
3. To Not Always Run this Program as an Administrator
A) Uncheck the Run this program as an administrator box, and click on OK. (See screenshots below step 1)
4. Open the program.
5. If prompted by
NOTE: If you are doing this is while logged in as standard user instead of an administrator, then you will need to provide the administrator's password before the program will run as administrator.
Using Advanced Properties
NOTE: This will allow you to always have the program run as an administrator when you open it.
1. Right click on the shortcut of the program, then click on Properties.
2. Click on the Shortcut tab for a program shortcut, then cllick on the Advanced button. (See screenshot below)
http://www.sevenforums.com/attachments/tutorials/12834d1243933304-run-administrator-advanc ed_properties1a.jpghttp://www.sevenforums.com/attachments/tutorials/12834d1243933304-run-administrator-advanc ed_properties1a.jpghttp://www.sevenforums.com/attachments/tutorials/12834d1243933304-run-administrator-advanc ed_properties1a.jpghttp://www.sevenforums.com/attachments/tutorials/12836d1243933304-run-administrator-advanc ed_properties2.jpghttp://www.sevenforums.com/attachments/tutorials/12836d1243933304-run-administrator-advanc ed_properties2.jpghttp://www.sevenforums.com/attachments/tutorials/12836d1243933304-run-administrator-advanc ed_properties2.jpgUAC, then click on Yes to apply permission to allow the program to run with full permission as an Administrator.
3. To Always Run this Program as an Administrator
A) Check the Run as administrator box, and click on OK. (See screenshot below)
4. To Not Always Run this Program as an Administrator
A) Uncheck the Run as administrator box, and click on OK. (See screenshot above)
5. Click on OK. (See screenshot below step 2)
6. Open the program.
7. If prompted by
NOTE: If you are doing this is while logged in as standard user instead of an administrator, then you will need to provide the administrator's password before the program will run as administrator

The domain users without administrative permission cannot install printers shared on printer server

Dears
We have a printer server that OS is Windows server 2003 .And all clinets are installed windows 7.Now,the domain users cannot installed printers shared on the printer server.When i logon the clinent computer with a domain user and access printer server by
URL \\192.168.37.1 ,i can see all printers shared on the printer server.Then i double click on printer to install it on client computer.It will ask me to input user name and password of local administrator .
How to install the printers with domain user directly. Thanks

refer step #8:
http://blogs.msdn.com/b/7/archive/2011/07/11/allowing-standard-users-to-install-network-printers-on-windows-7-without-prompting-for-administrative-credentials.aspx
Don
(Please take a moment to "Vote as Helpful" and/or "Mark as Answer", where applicable.
This helps the community, keeps the forums tidy, and recognises useful contributions. Thanks!)

I have windows vista user account with administrator privilege. I am unable to update mozilla firefox to the latest version. It is saying "do not have required privileges". I already uninstalled the previous version :(

I am unable to update mozilla firefox. I have user account with administrator privilege.

Try to run the installer as Administrator via the right-click context menu (Run as Administrator).

User Groups Missing - Administrative Privileges are Inaccessable

I really can't figure this one out - somehow all of the system's user groups have somehow been removed from my mac therefore disabling any administrative privileges, other than the root user. Even when logging in as root and selecting my user as an administrator, it doesn't recognize the privileges and I remain a 'Standard' user.
I've even tried removing the setup file (/var/db/.applesetupdone) in hopes that completing the initial setup with a NEW user again would allow an admin and reset the groups. This proved pointless as even the newly created user is merely a 'Standard' user and still cannot be activated as an admin from root.
I've already run just about every self-repair function that I have, and none of them see a problem. If anyone has a method to fix this without reinstalling leopard, please let me know - I can reinstall leopard if need be, but I would really rather just fix the problem.

did it really happen to all groups? then perhaps a reinstall is in order. if it only happened to the admin group you can fix its directory services entry as described here
http://discussions.apple.com/thread.jspa?messageID=10043721&#10043721
credit to biovizier for that method.

Win7 Ultimate Sole User Administrator Privileges Not Recognized for Automatic Windows Updates

I am a sole account/user (home-based and non-network) with system administrator privileges, except this status is not recognized under Windows Update > Change Settings > Important Updates. The option of selecting automatic updating
and an installation frequency/time is grayed out. How do I fix?

Hi KiDeb.
Did you have any changes prior this issue?
Could you confirm that Important Updates were installed before?
The possible solution could be this:
Hold WindowsKey + R
Type: “regedit”
Hit Enter
Go to: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
Find AUOptions.
Right Click Modify
You can change the values data from 1 through 5:
1. Download updates but let me choose whether to install them
2. Check for updates but let me choose whether to download and install them
3. Download updates but let me choose whether to install them
4. Install updates automatically / Never Check For Updates
5. Enable the option box to choose manually
If this doesn't help, you can try this method, but make sure you backup the registry files as you are doing this step on your own and I am not responsible for the possible issue -
Backup registry files in Windows 7
Click “Start” button.
Select “Run”.
Type “regedit” without quotes in the Run window and hit Enter.
Navigate to this location: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
In the right-pane, delete these two values “AUOptions” and “NoAutoUpdate”.
Then navigate to this location: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\WindowsUpdate
In the right-pane, delete the value “DisableWindowsUpdateAccess”.
Restart the computer and then try to change the Auto Update Settings.
Please click on Propose As Answer or to mark this post as and helpful for other people. This posting is provided AS-IS with no warranties, and confers no rights.

Give a windows domain user local administrative rights?

I'm familiar with managing servers/computers in a windows environment, and I can't seem to find a tool to do something similar in OS X 10.5. I'm getting ready to ship a macbook pro to an employee who will be authenticating against our active directory windows domain for login. The machine is already setup to allow this (and I'm able to log in using my network credentials currently). However, I'd like to also give the user administrative rights so he can install software as he sees fit. In windows, I would just goto the groups section and add the user by typing in his account as : Domain\user and it would add him to that group. I haven't been able to find anything similar with the MacBook so far. Any help would be greatly appreciated.
Message was edited by: vlitsupport
Also.. if this needs to be in another section of the forum, please let me know.
Thanks!
Message was edited by: vlitsupport

found a good tutorial:
http://www.smallbizserver.net/Articles/tabid/266/articleType/ArticleView/Article ID/234/PageID/359/Default.aspx

My user was changed to standard how may I obtain administrator privilege again

My user was changed to standard how may I obtain administrator privilege again

My user was changed to standard how may I obtain administrator privilege again

Administrator privileges to domain users

Similar Messages

Maybe you are looking for