Granting workstation admin rights to windows users

Is it possible to setup OD users to have administrator rights on the local workstation? In order to do this the user needs to be a member of the Administrators group on the local machine, however, I can't see any way of doing this in Workgroup Manager.
Thanks
Ian
iMac CoreDuo Mac OS X (10.4.6)

To make an account defined in Open Directory an administrator of a client's local domain, you have to define that account as an administrator at the client system.
On a Mac OS X system, log on as that user, then open the Accounts preference pane. Authenticate as an existing local administrator, then select the network account in the list and check "allow user to administer this computer." This effectively adds the network account as a member to the local admin group, as well as to the /etc/sudoers file, for allowing root access via su.
On a Windows XP system, log on as that user, open Control Panel, then Users & Accounts. You should have to authenticate as an existing local administrator to be able to continue. Select the network account and edit it, changing its type to Administrator. Note that you must have Windows XP Pro to do this; XP Home won't work.

Similar Messages

Is it can grant an admin right for special application ?(No Runas as Administrator)

Dear All
Background: We have an application which run on users group in server 2000 SP4 is normal.
We want upgrade the OS to Win7 , on the Win7 the application can not launch on normal users group.
I was try the properties of compatibility to server 2000 and choose "Run this program as an administrator" and edit the regedit key permission , both of all is not work on my case.
It is ok right-click the application and runas as administrator, but on the other hand I find runas administrator has some other error with the application.
May I know is it has a method can grant the admin right to special user when running special application ?
Regards All

Hi,
What application can not run in Windows 7? I think there is a application compatibility issue, so please attempt to run Program Compability troubleshooter.
Also, you said you got some error while you ran as administrator with runas command. And what are the errors?
RUNAS /user:<Username> Program
Based on my knowledge, we cannot grant the special user with admin right unless you add this special user to Administrators group. When a special user is running a application requiring administrator permission, it will prompt to input administrator username
and password.
Andy Altmann
TechNet Community Support

How to grant LOGON ONLY Rights to two users (no domain admins) on Domain Controllers

Dear Techies,
I wish to grant LOGON ONLY Rights to two users, who are not the members of Domain Admins, on Domain Controllers.
Can someone please suggest the best and easiest possible way to do this keeping up with Compliance?
Regards
Amit Kumar

I think it is by design, the readers don't have access to the operations and application management section. If you look at the URL's you will notice they are of the form http://servername:portnumber/_admin/operations.aspx and http://servername:portnumber/_admin/applications.aspx. Giving read only access to these pages means, they will be not able to modify the settings on these pages.
Looks like it is not possible to give read only access.
Thanks,
Prashanth

Granting an admin rights to view and execute a task with user actions

I am trying to grant an admin the rights to view and execute a new task that i have created from the search results and user actions applet.
I have added an auth type to the authorization types configuration object with the following:
<AuthType name="terminateUser" extends="TaskDefinition,TaskInstance,TaskTemplate"/>
I created a new task and assigned it this auth type. I then created the new admin group and assigned the following permissions:
<Permission type='terminateUser' rights='View'/>
I then added this capability to the admin role to which the user has been assigned. This admin role also has the view user capability and has been assigned to the top level of this organization as a controlled organization.
I also added the task to the user actions configuration so that the menu item appears in the context menu and on the find users page.
The user can see all users but cannot see the new task. The only thing that is visible is the "view" menu item.
I have other users that have lots more capabilites that can execute this task with no problems. I am wondering if the view user capability is the problem or is there some other capability that anyone knows of that I must add in order to allow this admin role to view and execute this task.
Thanks,
Ruth

BTW, the answer is to restart the app server. Duh!
Ruth

Is there any way to install a plugin without admin rights on windows 7

Hi all,
I've developed a plugin for adobe indesign cs5. I was able to install my plugin(by creating .msi file) into indesign plugins folder, when extension manager is opened as administrator.
I just want to know, if I can install the plugin without admin rights.
FYI: My plugin will add a link to File menu on menubar of the indesign application, clicking which will execute the scripts.
Please let me know if you want any other information.
Thanks for any ideas/support.
Regards,
Srikanth

InDesign will load plugins from the path specified in the PlugInConfig.txt file in the user's InDesign preferences directory, which does not require administrative privileges. See "Using PlugInConfig.txt" on pp.12- of the "Getting Started with the Adobe InDesign CS5 Products SDK" (getting-started.pdf) in the SDK. Specifically:
Using PlugInConfig.txt
1. If InDesign is running, exit it.
2. Create a text file named “PlugInConfig.txt” in the InDesign preference directory, and enter
the following text into it:
=Path
NOTE: The inDesign preference folder is located in the following directory (where <locale> is a
locale-specific subdirectory; for example, en_US for English):
Windows XP: C:\Documents and Settings\<user>\Application Data\
Adobe\InDesign\Version #.#\<locale>
Windows Vista: C:\Users\<user>\AppData\Roaming\
Adobe\InDesign\Version #.#\<locale>
Mac OS: <user-home>/Library/Preferences/
Adobe InDesign/Version #.#/<locale>
3. Open the PlugInConfig.txt file in a text editor and edit the sections as desired. For example,
the following tells InDesign to load every plug-in in the sdk folder:
=Path
"C:\Adobe InDesign CS5 Products SDK\build\win\debug\sdk
NOTE: The preceding example is only for Windows. On Mac OS, use ‘:’ as the path separator.
NOTE: You also can use a “=Exclude” tag to exclude a certain plug-in from being loaded. This
is useful if you do not want to load everything in the “=Path” folder.
NOTE: This is target specific. You cannot launch the release version of InDeisgn with debug
plug-ins. It is convenient to add both debug and release paths, commenting out the target that is not in use. For single-line comments, use “;” (semicolon).
4. Save the PlugInConfig.txt file.
5. Restart InDesign.
6. Verify the set of plug-ins loaded by selecting the About Plug-ins menu.

Script to Temporary Elevate the admin rights to local user

Hi Friends
i believe this topic was already discussed , however i could not find a solution .. please help
i need a script ( vb/power shell/bat ) etc which will run on local user with admin privilege ( will package and make it available in application store / software center ( sccm 2012 ) , it will run with admin rights on local computer ) and grant admin privilege
to the local user for 24 hours
My previous org had same, however the source is a .exe file, so not very sure if they have converted script to exe for privacy
Thank you
Tanoj
OSLM ENGINEER - SCCM 2007 & 2012

Hi,
Adds/Delets a global group name or user name to a local group.
net localgroup [GroupName name [ ...] {/add |
/delete} [/domain]]
Reference:
Net localgroup
http://technet.microsoft.com/en-us/library/bb490706.aspx
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Cannot set admin right to my user root account has STANDARD RIGHTS!

I had this common problem, my account turned to standard.
I followed the instructions here.
I changed the root password from the install DVD, restarted.
logged in as "root", but the root user has standard rights as well!!
therefore I cannot change the rights of my user...
any suggestions?

Wow, it looks like you went for the deluxe bugs package.
..."now I'm the adminstrator. but this didn't change the fact, that folder I'm creating ( doesn't matter where ) have "read only" rights for the admin. system has read write....
You hadn't mentioned that before, but actually that sounds like a completely different problem, one that can be caused by using "repair permissions" on a 10.5 volume while booted from a 10.4 (or earlier) disk - this might also include having used "DiskWarrior" to repair permissions (something the manufacturer advises against). Unfortunately, Apple is in the process of revising how "repair permissions" works, and the new method in 10.5 doesn't appear to be fully implemented. As a result, it does not fix this problem, which is purely a permissions issue. If this is indeed the problem, the most straightforward way to get back to a normal system is to reinstall - an "archive and install" while preserving network and user settings should be sufficient for this particular issue. If you are comfortable with the command line, it may be possible to change permissions manually - it would be necessary to attempt a permissions "repair" or "verify" under Leopard, and to record and carefully analyze the messages to determine what needs to be fixed, and how.
The "Finder" crashes are due to another bug - the GUI crashes when there are files or folders with a group ID that doesn't correspond to a group record in "DirectoryService". There are various strategies to use as workarounds: if all of the problem files have the same group ID, it is probably fastest just to create a group record for that group. If there are a number of different groups involved, doing a batch change of group from the command line might be easier. To get an ideal of what groups are involved, the following command can be used to display the various factors regulating access to a particular file or folder - try using it to survey a selection of different items exhibiting the problem:<pre>
ls -elO /path/to/item</pre>
Copying the items to an external drive, then copying them back to a folder that does not display "(unknown)" in "Get Info" might be another strategy (but note that there have been some reports of data loss copying large amounts of data - even after the 10.5.1 update, and even copying instead of moving). Ultimately, these are just workarounds and Apple really needs to fix this sooner than later - it's getting stupid.
But actually, considering all of the different issues you are experiencing, backing up the data to an external drive (and verifying the integrity of the backup), then performing a full "erase and install" might be the one stop solution. I'm not sure about the best strategy for reimporting the data once that is done since I have never used the Apple tools and do not know how they handle ownership and permissions (what is perserved, etc.) - hopefully someone else will be able to fill in those details.
So you were bitten by the "Get Info" crash bug, a second issue caused directly by following what turned out to be bad advice in an official kb article, and had a permissions problem that couldn't be resolved using the tool that is supposed to deal with permissions problem. I'd call that a Leopard beta hat trick.

How to update creative cloud without admin rights / workaround / windows 7

one of my co-workers is running creative cloud on a PC / windows 7. we're using typekit fonts in our AI files.
seems creative cloud wants to update pretty often, like every week.
THE ISSUE(S)
the user can't update it themselves without getting IT to login as admin to the PC.
we can't access the typekit fonts without the creative cloud app running.
we can't run the creative cloud app until we run the update (the updates are forced)
it's a major hold-up for us, as the team can't work on a file properly as the fonts are missing w/out CC running. and we can't update CC without IT. and we can't run CC without updating.
is there any workaround for this? can the CC updates be "turned off" or sceduled once a month or something like that?
thanks!!

This is an excellent point – all other updates in Creative Cloud are unforced and up to the customer as to when they are installed... The Creative Cloud Desktop app should be as well.
Hope Adobe can change this.
Note: Here is the update history, on average about once per month –
http://helpx.adobe.com/creative-cloud/release-note/cc-release-notes.html

Read user groups from realm. Admin rights to each user ??

Greetings to ALL,
I am reading users, groups from realm. If I give the user admin priviliges I am
able to get the information else I get the error weblogic.management.NoAccessRuntimeException:
Access not allowed for subject: principals=[ruser1, B10AP01, B10MP01, B10MP03A,
B10MP03], on ResourceType: Security:Name=myrealmDefaultAuthenticator Action: execute,
Target: listGroups
Is there more effective way to read the information.
I can execute the program standalone ( from DOS PROMPT) and read all information
if I do the following
adminHome = (MBeanHome) Helper.getAdminMBeanHome (username,password,url);
But when calling from the application I get the above error.
Any code, suggestion will be very helpful.
Fred

"Fred Boon" <[email protected]> wrote in message
news:3fa7cb98$[email protected]..
>
Greetings to ALL,
I am reading users, groups from realm. If I give the user admin priviligesI am
able to get the information else I get the errorweblogic.management.NoAccessRuntimeException:
Access not allowed for subject: principals=[ruser1, B10AP01, B10MP01,
B10MP03A,> B10MP03, on ResourceType: Security:Name=myrealmDefaultAuthenticatorAction: execute,
Target: listGroups
Is there more effective way to read the information.
Commo mbeans require admin role in order to be able to invoke methods.
I can execute the program standalone ( from DOS PROMPT) and read allinformation
if I do the following
adminHome = (MBeanHome) Helper.getAdminMBeanHome (username,password,url);
But when calling from the application I get the above error.
Try doing a runAs with a subject that has admin role.

Is it possible to set up ADFS without domain admin rights in Windows 2012 R2?

I've set up Windows 2012 R2 on my development box and want to enable the ADFS feature to test claims based authN. In ADFS 2.0, you could opt to install standalone and local admin privileges would be enough to install ADFS and authenticate against the domain
AD.
However, with the new ADFS, after installing the feature it asks to enter the credentials for an account that is a domain admin. Is it still possible to configure ADFS without domain admin privileges?

Hi,
According to my research, if you want to set up AD FS in Windows server 2012 R2, each computer
that functions as a federation server must be joined to an Active Directory domain.
Besides, AD FS requires a certificate for SSL server authentication on each federation server in your federation server farm. Furthermore, you need a membership in
Administrators on the local computer to install the AD FS role service.
For more detailed information, please refer to the links below:
How to deploy AD FS in Windows Server 2012 R2
http://technet.microsoft.com/en-us/library/dn303423.aspx
Best regards,
Susie

Question on ADMIN rights for EP user with ECC also installed on same system

Hello EP/ECC gurus
I have a situation here where we have installed EP and ECC on the same system using same SID and system number.
I have logged into ECC using a user name that has been registered as a developer.
I can create a table, populate with data etc., without any problem.
However, when we try to use EP, we are getting errors that the says that there are no roles assigned to this user.
What are we doing wrong? Any suggestions or recommendations will be highly appreciated.
Thanks
Ram

Hi Ram,
When the installation of EP was performed it should have created a user named J2EE_ADMIN. Try to log on to the portal with this account (password should be known from time of installation). You can examine the user/role assignments of your developer user and assign the portal roles you would like that particular user to have accordingly.
Regards
Daniel

Grant user admin rights, install itune, ungrant rights?

On Windows XP, installing iTunes requires admin rights. However, it is not good to use an admin account for regular work. For the Palm Desktop, the workaround was to grant admin rights to the user account, install the application using the user-turn-admin account, then ungrant admin rights. Will this last step cause problems for iTunes, or does iTunes require admin rights for its regular operation (outside of being installed)?

Actually, I can't find the thread! But the solution is that installing it as Admin still lets it be used by other user accounts, and each user account.

Installation Server and Windows 7 - Admin Rights Issue

Here is a good one. Completely reproducible error when granting Local Admin Rights by the LSH Service.
For those with SAPGui Installation Server (SAPGui 7.20 Patch 6 or above) ... try this on a Windows 7 SP1 front end when you are NOT logged on with local admin rights.
1) Open the Windows RUN dialog
2) Type path to your installation server\setup\nwsapsetup.exe
3) You should find the install wizard starts (granting local admin rights) as expected.
NOW TRY THIS
1) Type path to your installation server\setup\nwsapsetup.exe /uninstall
2) You will find that you get a dialog about can't grant admin rights. Un-install will abort.
This only appears to happen with the /uninstall switch! Using /product= for example it will still grant admin rights.
BIZZARE ...
I've opened a Customer Support Message (Friday) priority - MEDIUM have not heard back from SAP Support yet.
Bob

Jude,
Thanks, it looks like that note has been getting a lot of update activity lately because the newly released Patch 8 has nwsapsetup.exe as version: 8.6.1.62 and that version also has the issue with the /nnnnnn switches.
I do have to say however, that this issue with nwsapsetup.exe and admin rights (requiring SapSetup.exe_Patch) first appeared with the release of Patch 6 for the Gui. It was fixed for WinXP (I had a customer support message opened on this). So why didn't anyone also test on Win7?
Who is QA-ing these software releases?
Patch 8 had the same problem.
The change log for SapSetup.exe_Patch, is up to 8.1.6.70 now.
How are we in large enterprises to feel comfortable deploying any of this?
End of rant ....
Bob
P.S. I really appreciate your presence here ... the tech assigned to my formal Support Message on the matter still has not gotten back advising of the updated release of SapSetup.exe_Patch.
Message: 0000746888
Edited by: Bob Held on Sep 16, 2011 10:30 PM

Giving an OD Network User/Group local admin rights.

Is there a way to manage workstation admin rights from the server?
I ran into a problem with Lightroom that requires admin privileges to change the program preferences. We have alot of graphic art students with roaming profiles, spread out across 5 labs, that need to make this change. I would like to be able to add a group or all network users to the local admin group, for a few days, so the students can make the changes.

This works on 10.5, not sure about 10.6.
As root on the client.
Upgrading legacy group for local admin group - this is from 10.4 days, not sure if you still need to do it.
dseditgroup -o edit -f n -t group -n /Local/Default admin
Nest OD group in local admin group
dseditgroup -o edit -a DirectoryAdminGroup -t group -n /Local/Default admin
Gen

Deployment Software on user with no admin rights

Hello,
We are using SCCM 2012 R2 and our environment machines are Windows 8.1 with no admin rights for all users.
We are trying to deploy some sprecific software but with no luck.
On the Deployment method we specify "Install for User" and what happens on User side is "Past due it will be retried".
If I modify my script and instead of /qn I use /qb I have the UAC control that pops up.
But from my understanding SCCM should install the software as system account.
How can we do to make it work?
Thank You,
Chris

Hello,
I have already bypass my problem using the "install for system".
Creating 2 deployment method. One for the application (msi) "Install for system" and the second for the settings (cmd) "Install for User" and it works like a charm.
But there is no way for SSCM to elevate the privileges when installing an application with "Install for user" set?
Chris

Granting workstation admin rights to windows users

Similar Messages

Maybe you are looking for