Grant user admin rights, install itune, ungrant rights?

On Windows XP, installing iTunes requires admin rights. However, it is not good to use an admin account for regular work. For the Palm Desktop, the workaround was to grant admin rights to the user account, install the application using the user-turn-admin account, then ungrant admin rights. Will this last step cause problems for iTunes, or does iTunes require admin rights for its regular operation (outside of being installed)?

Actually, I can't find the thread! But the solution is that installing it as Admin still lets it be used by other user accounts, and each user account.

Similar Messages

Is it can grant an admin right for special application ?(No Runas as Administrator)

Dear All
Background: We have an application which run on users group in server 2000 SP4 is normal.
We want upgrade the OS to Win7 , on the Win7 the application can not launch on normal users group.
I was try the properties of compatibility to server 2000 and choose "Run this program as an administrator" and edit the regedit key permission , both of all is not work on my case.
It is ok right-click the application and runas as administrator, but on the other hand I find runas administrator has some other error with the application.
May I know is it has a method can grant the admin right to special user when running special application ?
Regards All

Hi,
What application can not run in Windows 7? I think there is a application compatibility issue, so please attempt to run Program Compability troubleshooter.
Also, you said you got some error while you ran as administrator with runas command. And what are the errors?
RUNAS /user:<Username> Program
Based on my knowledge, we cannot grant the special user with admin right unless you add this special user to Administrators group. When a special user is running a application requiring administrator permission, it will prompt to input administrator username
and password.
Andy Altmann
TechNet Community Support

Granting an admin rights to view and execute a task with user actions

I am trying to grant an admin the rights to view and execute a new task that i have created from the search results and user actions applet.
I have added an auth type to the authorization types configuration object with the following:
<AuthType name="terminateUser" extends="TaskDefinition,TaskInstance,TaskTemplate"/>
I created a new task and assigned it this auth type. I then created the new admin group and assigned the following permissions:
<Permission type='terminateUser' rights='View'/>
I then added this capability to the admin role to which the user has been assigned. This admin role also has the view user capability and has been assigned to the top level of this organization as a controlled organization.
I also added the task to the user actions configuration so that the menu item appears in the context menu and on the find users page.
The user can see all users but cannot see the new task. The only thing that is visible is the "view" menu item.
I have other users that have lots more capabilites that can execute this task with no problems. I am wondering if the view user capability is the problem or is there some other capability that anyone knows of that I must add in order to allow this admin role to view and execute this task.
Thanks,
Ruth

BTW, the answer is to restart the app server. Duh!
Ruth

VS2010 Crystal 13 click-once deployment without user admin rights?

The only supported way of deploying our runtimes is to use one of our prepackaged msi's.
We do not have any documentation for manual deployment or anything that lists what specific dlls, registry settings, etc are needed to run specific configurations (ie web app vs windows apps).
Jason

As well as what Jason posted CR MUST have local PC Admin rights because we need to get past DEP/UAC etc. as well as be able to register the COM components, insert all of the registry keys required and the usual folder creation and file copying. Without it CR simply won't install properly and your app will never run. As noted in those other posts if you write a .NET app you have no choice but to use/set the native permissions and file distribution. If it's a WEB based app the you deploy it on each WEB server, users get a Viewer and Printer control through a browser download. But for Windows, it's a must.
IT departments have the ability to push out Special permissions for users to install software, not a CR configuration so check with your IT group or Microsoft and search on Profiles. So the each users doesn't need to be granted Admin rights to use it but they need it to install, assuming when installed it's set for All users. Other option is a local network Admin install on each PC. Not the nice way of doing things though.
Bottom line is because it's a Native .NET windows app you have no choice but to distribute all of CR's runtime and dependencies.
Don

Removing User Admin Rights

I am currently assisting in managing a domain of 3-4000 users. All of our users have administrative privileges on their machines. We are looking into several different ways of removing these administrative rights for obvious security reasons.
I have read about privilege management software like Avecto, but it would be great if you could utilize something like Restricted Groups in Active Directory or SCCM 2012R2 to achieve this somehow.
I read about Restricted Groups here:
http://www.windowsecurity.com/articles-tutorials/windows_os_security/Using-Restricted-Groups.html
I am wondering if we can achieve this by deploying these Restricted Group GPO's. I understand that these GPO's are linked to computer accounts though, but from what I am under the impression I can restrict adding accounts to the admin group and explicitly
allow other accounts.
Our AD functional level is 2008R2 and 99% of our workstations are running Win7 32-bit. Has anyone had any experience removing user administrative rights without purchasing third-party software?

We are in the process of deploying Avecto Privilege Guard (new name is DefendPoint).
We are doing this in conjunction with revising our GPP-Local Users & Groups settings (which we decided to use some time ago, instead of using classic Restricted Groups).
You'll need to use some method (and GP seems to be a good one) to take control of the local Administrators group membership.
Avecto PG can/will block all attempts to modify that group (due to its anti-tamper protections), but, presumably like us, you will need to evict unauthorised members of that group, and then protect that group from further modifications.
We also found, that the anti-tamper protections of Avecto PG, even prevent GP from cleaning up the group members, and it was suggested to us by Avecto support, that we create Avecto PG policy which allows the LocalSystem to bypass the protection. (GP CSE's
like this, will run in LocalSystem context)
You don't need Avecto PG to remove admin rights, you can do it with Domain GP. But, how do you maintain that position/integrity? And, how do you then allow users to perform some tasks, tasks which require privilege but your organisation approves of those
tasks being performed by users, but Windows doesn't allow that?
There are many types of technical controls to implement "security" (if that is your goal), but, you will find that each and every control can be bypassed with enough time and effort. Especially if your users are the determined type of person, who
also considers that their need to "do that thing" will make them productive/happy - they will ignore all company policies in pursuit of that productivity/happiness (or so it seems to me from my experience)
IT Support efforts/costs will rise, not drop - we are seeing this already.
Hatred towards IT (both systems and the people in IT) is also rising.
Don
(Please take a moment to "Vote as Helpful" and/or "Mark as Answer", where applicable.
This helps the community, keeps the forums tidy, and recognises useful contributions. Thanks!)

Granting workstation admin rights to windows users

Is it possible to setup OD users to have administrator rights on the local workstation? In order to do this the user needs to be a member of the Administrators group on the local machine, however, I can't see any way of doing this in Workgroup Manager.
Thanks
Ian
iMac CoreDuo Mac OS X (10.4.6)

To make an account defined in Open Directory an administrator of a client's local domain, you have to define that account as an administrator at the client system.
On a Mac OS X system, log on as that user, then open the Accounts preference pane. Authenticate as an existing local administrator, then select the network account in the list and check "allow user to administer this computer." This effectively adds the network account as a member to the local admin group, as well as to the /etc/sudoers file, for allowing root access via su.
On a Windows XP system, log on as that user, open Control Panel, then Users & Accounts. You should have to authenticate as an existing local administrator to be able to continue. Select the network account and edit it, changing its type to Administrator. Note that you must have Windows XP Pro to do this; XP Home won't work.

Granting a user admin rights for computer binding only

Our OD is configured to require authentication when binding a computer to the directory. We want to give this responsibility to the help desk department but we do not want them to have the "diradmin" password. We also do not want them to be able to modify users/groups. They should only be able to bind computers. Is this possible?

Leif Carlsson wrote:
Any OD user is supposed to be able to bind computers to the OD up to 10 times.
I haven't really tried this and is also interested in knowing if there is an ability to have what you are asking for.
Do you have any documentation to support that? I can't support that claim. Below I will post a log of a user (y000xyz) being created by diradmin then being denied when binding a computer via "Directory Utility" with the error "y000xyz is not an administrator"
Apr 22 2010 06:29:42 AUTH2: {0x4bcde0fe6b8b45670000000200000002, diradmin} DHX authentication succeeded.
*Apr 22 2010 06:29:42 NEWUSER: {0x4bcde0fe6b8b45670000000200000002, diradmin} created new user {0x4bd04f463531a0290000000d0000000d, y000xyz}*
Apr 22 2010 06:30:09 RSAVALIDATE: success.
Apr 22 2010 06:30:09 AUTH2: {0x4bd04f463531a0290000000d0000000d, y000xyz} DHX authentication succeeded.
Apr 22 2010 06:30:09 RSAVALIDATE: success.
Apr 22 2010 06:30:09 USER: {0x4bd04f463531a0290000000d0000000d, y000xyz} is the current user.
Apr 22 2010 06:30:09 AUTH2: {0x4bd04f463531a0290000000d0000000d, y000xyz} CRAM-MD5 authentication succeeded.
Apr 22 2010 06:30:11 RSAVALIDATE: success.
Apr 22 2010 06:30:11 AUTH2: {0x4bd04f463531a0290000000d0000000d, y000xyz} DHX authentication succeeded.
Apr 22 2010 06:30:11 RSAVALIDATE: success.
Apr 22 2010 06:30:11 USER: {0x4bd04f463531a0290000000d0000000d, y000xyz} is the current user.
Apr 22 2010 06:30:11 AUTH2: {0x4bd04f463531a0290000000d0000000d, y000xyz} CRAM-MD5 authentication succeeded.
*Apr 22 2010 06:30:11 CHANGEPASS failed because {0x4bd04f463531a0290000000d0000000d, y000xyz} is not an administrator.*
Message was edited by: iSauce

CC for teams with Managed Desktops (ie no user admin rights)

HI,
Just getting started with CC for Teams. I like the concept of assigning users, but finding some lumps in our environment: Windows 7 with managed multiuser desktops. USers have limted rights on their workstations and cannot install software. Also we have users who use more than 1 system or use a system in a confernece room while in collaborative meetings.
So users cannot download from adobe and run installer - no rights. Oh well its really slow anyway....Oh yeah updates - those don't work as well either....
I need to distribute the apps to the workstations and allow users to sign in and out. I can see that I may be able to get it to work with SCCM, but for now to test I logged in as admin, signed into CC, installed an app, then logged out of cc.
Invite UserA to the team.
UserA logs in, starts app, signs into CC - all good so far. But to sign out user gets an error - please start in administrator mode.
WHAT!?? userA needs does NOT need admin priveleges to sign in but DOES need them to sign out???
Is there a resolution for this or some kind of workaround? Otherwise I have to log into the workstation as admin to log the user out? That pretty much defeats the value of the admin console.
BTW - It really would be even nicer it it just use their windows credentials (or have the log in mechanism manage the CC connection) - log in to the desktop and you are good to go - log out and you are signed out of cc as well.
PS - please fix the multiple license acceptance thing - feel like I'm using the nav system in my car - ONCE is enough...

Same problem here, on Mac OS X. Maybe someone at Adobe can elaborate on what they were thinking and how they're going to address this issue...

Installation Server and Windows 7 - Admin Rights Issue

Here is a good one. Completely reproducible error when granting Local Admin Rights by the LSH Service.
For those with SAPGui Installation Server (SAPGui 7.20 Patch 6 or above) ... try this on a Windows 7 SP1 front end when you are NOT logged on with local admin rights.
1) Open the Windows RUN dialog
2) Type path to your installation server\setup\nwsapsetup.exe
3) You should find the install wizard starts (granting local admin rights) as expected.
NOW TRY THIS
1) Type path to your installation server\setup\nwsapsetup.exe /uninstall
2) You will find that you get a dialog about can't grant admin rights. Un-install will abort.
This only appears to happen with the /uninstall switch! Using /product= for example it will still grant admin rights.
BIZZARE ...
I've opened a Customer Support Message (Friday) priority - MEDIUM have not heard back from SAP Support yet.
Bob

Jude,
Thanks, it looks like that note has been getting a lot of update activity lately because the newly released Patch 8 has nwsapsetup.exe as version: 8.6.1.62 and that version also has the issue with the /nnnnnn switches.
I do have to say however, that this issue with nwsapsetup.exe and admin rights (requiring SapSetup.exe_Patch) first appeared with the release of Patch 6 for the Gui. It was fixed for WinXP (I had a customer support message opened on this). So why didn't anyone also test on Win7?
Who is QA-ing these software releases?
Patch 8 had the same problem.
The change log for SapSetup.exe_Patch, is up to 8.1.6.70 now.
How are we in large enterprises to feel comfortable deploying any of this?
End of rant ....
Bob
P.S. I really appreciate your presence here ... the tech assigned to my formal Support Message on the matter still has not gotten back advising of the updated release of SapSetup.exe_Patch.
Message: 0000746888
Edited by: Bob Held on Sep 16, 2011 10:30 PM

Are full admin rights required to generate webhelp in RH8?

My team has used RoboHelp for the past 10+ years, upgrading as needed. We were granted full admin rights on our PCs by our IT department several years ago so that our HTML webhelp would generate properly using RH5. We have now upgraded to RH8 but the IT department is going to take away our full admin rights.
Do we still need full admin rights on our PCs to generate HTML webhelp projects in RH8? The Installing and Activating RoboHelp topic on www.grainge.org is not clear on this.
We typically copy the entire RH8 project to our C drive, work and generate there and then move them back to our company network drive for deployment.
If someone can help claify for us it would be great.

The answer is no, admin rights are not required to generate webhelp or any other output. They are required to install RoboHelp but are not required thereafter. You do of course need write permissions for the folder to which you are generating but that should be on your hard disk and therefore automatic.
Your IT department can check your permissions.
See www.grainge.org for RoboHelp and Authoring tips
@petergrainge

Local Admin Rights - add / remove ?

Is there a way to add and remove local admin rights for users at logon / logoff in Server 2008?
Workstations are XP sp3 and Windows 7 Sp1. We have users who move from computer to computer and they need local admin access but we would prefer to not have Domain Users have local admin rights to all PCs.

Hi,
As far as I can see we can add user to local admin group at logon, but the user should relogon to get the membership, and if we also remove the user from local admin at logoff, then this equal to do nothing.
To add a domain user to a single computer as local administrator using GPO, I would like to suggest you go through the below similar threads:
Use GPO to add a single admin user to only one computer on the domain.
http://nerddrivel.wordpress.com/2013/05/24/use-gpo-to-add-a-single-admin-user-to-only-one-computer-on-the-domain/
How do I add a domain user to a single computer as local administrator using GPO
http://social.technet.microsoft.com/Forums/en-US/0a3eda5c-28ef-418e-a13d-f47fe0bf1bc3/how-do-i-add-a-domain-user-to-a-single-computer-as-local-administrator-using-gpo
Granting Local admin rights via Group Policy to a particular computer
http://social.technet.microsoft.com/Forums/windowsserver/en-US/4ceff330-0b72-4ed2-a55a-3089b504d2fc/granting-local-admin-rights-via-group-policy-to-a-particular-computer?forum=winserverGP
Hope this helps.
Regards, Yan Li

GPO - 2012 - Enforce Local Admin Right

Hello,
Just wondered if there was a way to deploy a GPO to enforce local admin rights for individual endpoints.
We need a way to control who has local admin rights to what, but in this case we need to say grant local admin rights to Users A, B and C on workstations D, E and F only.
Other than creating a GPO 'per workstation' I don't see a way. DFL / FFL will be 2012.
Anyone got any ideas?
Thanks
Stuart

Hello
Thank you for the reply. This issue is a little hard to grasp and to explain clearly. I understand what you have said, I am fairly proficient with Group Policy.
I want to be able to give one single user, access to one single PC and control it centrally. I think that is a better way of explaining it. So if I have 100 PCs and 100 users, and say 20 of those users needs to have admin rights on their own
PC only and not on other PCs.
That is what I am trying to accomplish. If I great a security group called 'Desktop Admins' then link a GPO to an OU where the 100 PCs are, then security filter by the security group, then everytime I add in a user, they will get local admin rights
to all 100 PCs. However I only wanted to grant them local admin rights on one PC. That being their PC.
I want to manage this centrally rather than remotely assigning local ACLs. I also like GPO because if a local admin user decides he/she wants to give their mate local admin rights on their PC, GPO will overwrite it.
Hope that makes sense
Much Appreciated

Sending Publisher Connection Key gives Admin Rights in Contribute CS4

I manage numerous remote sites around the country remotely using Contribute CS4. Each site uses a common template with different header images and left navigation.
All of these sites function beautifully except one. On this particular site, sending a publisher connection key allows the user to connect to and edit pages on the site. However, the connection shows my (admin) email address, gives the user admin rights, and then puts a lock (.lck) file on almost all of the files, including the .CSS file. It also gives odd messages about workflow errors.
From my end on the Contribute Administer Websites panel, the user shows up as publisher, but on their end, they have admin rights and my email address displays on their connection
I tried deleting all of the files in the _mm and _notes folders and starting over, but this did not fix the problems.
Any help on this would be greatly appreciated.

Hi,
Did you try re-creating Publisher keys for them, and sending it to your client? Also, with the existing key which your client has, what is the Role information for that connection key? This can be checked in the My Connections dialog.
Where is your e-mail address being shown? If it is in the My Connections dialog along with the connection name, then that is because the administrator's e-mail address is shown there.
Hope this helps.

Make Mobile User Admin

I have several laptops with mobile accounts. I want to give the user almost complete control of the laptop in case they want to install software or whatever.
Via WGM, how do I give a user admin rights?
I tried creating an account on my computer and watched for changes in the Library preferences, but could not find what changed.
Can anyone help?

Does it work if you add that account to the membership of the admin group? If for some reason this cannot be done in the Workgroup Manager and you are using NetInfo, you can do it by adding that account's short name to the membership of the admin group on the computer in the NetInfo Manager. In addition, there may be something useful on this page.
(15425)

Giving Non-Admin User Admin Privileges to One Program

Aaron19 wrote:
Unfortunately updates don't erratic on when they come out.
Are erratic?
I'm assuming the updates happen with such frequency that requiring IT to install them is a major hassle. Your other option is to find a way to script the install and push it to the required workstations.

I thought I would come to the community and ask if there is any way to give a non-admin user admin rights to one program so that he can run updates. I looked into making an elevated shortcut which worked to no avail. Unfortunately updates don't erratic on when they come out. Was just curious if there is an ability to give the user who is having problems admin privileges to this program without an admin password.
This topic first appeared in the Spiceworks Community

Grant user admin rights, install itune, ungrant rights?

Similar Messages

Maybe you are looking for