Non admin in a domain environment

hi
i have installed cs6 for my users who are on my windows domain using windows 7 (x64) pc's - the problem we're having is that they need to run the updater to get the latest RAW file compatability etc but can't as they're not administrators.
i don't really want to give the admin accounts on the pc's / domain so does anyone have any suggestions?!!
thanks.
Elliott

Group policies, possibly in combination with file permissions. You could just create a special user group and limit it to certain operations whiel allowing others. You will need to give your users some form of admin access, no matter what. Installs always require registry and file access to the oeprating system. also you could run such stuff via a startup script that runs the isntall via silent deployment and/or creates a dummy user only to delete it afterward...
Mylenium

Similar Messages

Installation rights to non-admin domain users

I am looking for a GPO which will allow non-admin domain users to install specific software updates...mainly Anti-virus, adobe or java updates.
Please suggest!!

Hi,
Sorry, it seems that we can’t do this.
However, we can consider to use Software Installation Group Policy or WSUS to centrally update these software.
Regarding this topic, the following threads can be referred to for more information.
Allow non-admin users to install software updates of specific program
http://social.technet.microsoft.com/Forums/en-US/bb19a938-edae-459f-b2e1-b0ef2c836824/allow-nonadmin-users-to-install-software-updates-of-specific-program?forum=winserverGP
How to allow non-admin users to install software updates of Java, FLASH and Adobe Reader?
http://social.technet.microsoft.com/Forums/en-US/6a939857-6ec9-4100-8333-cddc27c3f58e/how-to-allow-nonadmin-users-to-install-software-updates-of-java-flash-and-adobe-reader?forum=winserverGP
Best regards,
Frank Shen

System PATH environment variable issue when user log off and log in or switch from admin to non-admin account

Hi,
Problem Description:
After installing my new product version, when user does log-off and log in again into admin account
or switch from admin account to non-admin account, PATH environment variable shows incorrect path of my product (previous product version’s path) using command prompt.
It seems windows refresh issue during session changes (log off and log in / switch from Admin to
Non-admin account).
Why PATH environment variable is not refresh immediately after log off and log in again or Switch
from admin to non-admin mode?.
Please see my thread for more details http://social.msdn.microsoft.com/Forums/vstudio/en-US/445ab42c-bdff-405a-8d53-558e1b6c7d34/path-environment-variable-issue-when-user-logoff-and-login-or-switch-from-admin-to-nonadmin?forum=windowsgeneraldevelopmentissues
Also submitted bug for this in connect.microsoft.com portal.In that it has lots of information
like problem statement, Reproduction steps and Expected Results.
Bug ID: 871782
Could you please any body help me for this?. your support will be appreciated.
Thanks,
Marichamy

Why PATH environment variable is not refresh immediately after log off and log in again or Switch
from admin to non-admin mode?.
I wouldn't have any expectation of what you are doing to work the way you expect. E.g. why is the %ABC% being replaced at all? There is some help about this ambiguous scenario in the cmd help...
/V:ON Enable delayed environment variable expansion using ! as the
delimiter. For example, /V:ON would allow !var! to expand the
variable var at execution time. The var syntax expands variables
at input time, which is quite a different thing when inside of a FOR
loop.
/V:OFF Disable delayed environment expansion.
So, what's the setting for the /V: switch that your users would be using? Perhaps you should be using the ! instead of the % for your ABC variable?
Oh. There's more below where I found that...
Delayed environment variable expansion is NOT enabled by default. You
can enable or disable delayed environment variable expansion for a
particular invocation of CMD.EXE with the /V:ON or /V:OFF switch. You
can enable or disable delayed expansion for all invocations of CMD.EXE on a
machine and/or user logon session by setting either or both of the
following REG_DWORD values in the registry using REGEDIT.EXE:
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DelayedExpansion
and/or
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DelayedExpansion
to either 0x1 or 0x0. The user specific setting takes precedence over
the machine setting. The command line switches take precedence over the
registry settings.
In a batch file the SETLOCAL ENABLEDELAYEDEXPANSION or DISABLEDELAYEDEXPANSION
arguments takes precedence over the /V:ON or /V:OFF switch. See SETLOCAL /?
for details.
If delayed environment variable expansion is enabled, then the exclamation
character can be used to substitute the value of an environment variable
at execution time.
So, I guess the essence of your "bug" will boil down to whether you
need the feature to get the result you want and the
truth of that first sentence but it certainly looks like a "can of worms" to me. ; )
HTH
Robert Aldwinckle

PE13 on Windows 8.1 and non-admin or UAC issues?

Before I try to evaluate Premiere Elements 13 64-bit, I want to ask if lingering problems related to UAC and non-admin user accounts were resolved since version 11.
It's good to see a 64-bit version of Elements come out since then.

Gordon Fecyk
On what computer operating system is your Premiere Elements 13 running? For now I will assume Windows 7, 8, or 8.1 64 bit.
Not sure what you mean by:
It's good to see a 64-bit version of Elements come out since then.
assume you mean version 11. So in that case....
Premiere Elements Windows 10, 11, 12, and 13 are 64 bit applications when installed and run on specifically on Windows 7, 8, or 8.1 64 bit. Other Windows versions are 32 bit applications in 32 bit system or 32 bit application running in the 32 bit compatibility mode of 64 bit system. On the Mac side of things, it is my recollection that Premiere Elements 11 Mac was the first to be a 64 bit application when run on Mac 64 bit system.
It is my understanding that nothing has changed over the versions with regard to Premiere Elements and the matter of "UAC and non-admin accounts". Probably Microsoft would be a good source on that. Recent threads seem to suggest that Premiere Elements is not working with Domain accounts.
This is not Adobe. Rather a user to user forum. If you want to contact Adobe about your feature requests, you could consider the Adobe Feature Request Bug Report Form.
https://www.adobe.com/cfusion/mmform/index.cfm?name=wishform&loc=en
When you have specific problems with aspects of your Premiere Elements 13 purchased or tryout, we would be glad for the opportunity to be of assistance. Definitely recommend tryout before purchase to assure the compatibility of your program with your specific computer environment and your project goals.
ATR

In domain environment standard users can't open .psd files

in domain environment with non admin users; getting this error: http://imageshack.com/a/img543/9085/cdnu.png
only administrators can open .psd files
what permissions needs a standard user to open .psd files?

did fw work previously to open psd files? - no, only admin users can open psd files wiht fw or ps.
do you see that error with all psd files? - yes, all psd files give this error, no error given jpeg or png files
are those cs6 psd files? - yes.
what happens if you right click fw>click 'run as administrator'? - same error.
i have to give local administrator rights to users that they can work with psd files.

How to allow access to winrs for non-admin user?

I have Windows Server 2012 (and Server 2008, but it is next priority) to monitor it using txwinrm. txwinrm library internally is using WinRS protocol. I have to monitor it using least privileged user, but don't know how to configure access for him.
All I managed to do - is to configure remote Powershell session for my user, but it's look like that winrs and powershell sessions have different security descriptors:
Invoke-Command -ComputerName 192.168.173.206 -Credential (credential Administrator $pwd) -ScriptBlock { 2 + 2}
# gives 4
Invoke-Command -ComputerName 192.168.173.206 -Credential (credential lpu1 $pwd) -ScriptBlock { 2 + 2}
# gives 4
winrs -r:192.168.173.206 -u:Administrator -p:$pwd 'powershell -command "2+2"'
# gives 4
winrs -r:192.168.173.206 -u:lpu1 -p:$pwd 'powershell -command "2+2"'
# Gives Winrs error: Access is denied.
Configuration for my user is following:
(Get-Item WSMan:\localhost\Service\RootSDDL).value
# O:NSG:BAD:P(A;;GA;;;BA)(A;;GA;;;S-1-5-21-3231263931-1371906242-1889625497-1141)S:P(AU;FA;GA;;;WD)(AU;SA;GWGX;;;WD)
(Get-PSSessionConfiguration -name Microsoft.Powershell).SecurityDescriptorSddl
# O:NSG:BAD:P(A;;GA;;;BA)(A;;GA;;;S-1-5-21-3231263931-1371906242-1889625497-1149)S:P(AU;FA;GA;;;WD)(AU;SA;GXGW;;;WD)
(In each security descriptor my user is given general access to protected object).
So what security descriptor should I set to make my winrs query work for non-admin user?

Hi Bunyk,
I can not recreate the erroe you posted, and please also post the screenshoot in your convenience.
I tested with a non-domain user but has the local admin permission of the remote computer, and this worked, before running the remote cmdlet in powershell, I also configured the TrustedHosts.
In addition, the access denied could be also caused to the Protocol Filtering on the remote server, for more detailed information, please refer to this thread:
winrs error:access is denied
I hope this helps.

Access to Resources via Non-admin accounts

Is there any way to provide access to resources so that they are accessible via
non-admin accounts. For e.g. to Retrieve my JMSConnectionfactory i do a
Environment env = new Environment();
env.setProviderUrl(url);
env.setSecurityPrincipal(username);
env.setSecurityCredentials(password);
Context ctx = env.getInitialContext();
The username and password here is the admin account. This works fine but if i
use a non-admin account(member of Operators group), i get exceptions on Domainloghandler
runtime
Problem: I need to register a mbean that needs to access JMS Resources. Since
our deployment team doesnt want to provide us access to admin accounts, we use
a "operators" group account to register our mbeans. if i do this, i get a
Access not Allowed for subject:principals=[operator, Operators], on ResourceType:
DomainLogHandlerRuntime Action: execute Target: registerToMe.
This happens when my managed resource tries to access a JMS ConnectionFactory.
Instead if i register my mbeans using the admin account, everything is fine and
my managed resource works nice.
This is on weblogic 81 SP1 on Solaris. Please let me know if you need more details.
Any clues/hints/solutions greatly appreciated. There is not a lot of documentation
on how to access/register mbeans using non-admin accounts.
TIA
Raj

I have done some more debugging on this and have narrowed down the issue to the
location where my initialcontext is being obtained.
so if i register my mbean as a non-admin account and do an operation on the managed
resource which fetches initial context, i get the below exception. This is how
i get my initialcontext
weblogic.jndi.Environment env = new weblogic.jndi.Environment();
env.setProviderURL("t3://machine:8102,machine:8103");
env.setSecurityPrincipal("operator");
env.setSecurityCredentials("operator");
Context ctx = env.getInitialContext();
I am doing this from a mbean thats registered on a different managed server(t3://machine:8101)...
Whats wrong with this?
TIA
Raj
"Raj" <[email protected]> wrote:
>
Is there any way to provide access to resources so that they are accessible
via
non-admin accounts. For e.g. to Retrieve my JMSConnectionfactory i do
a
Environment env = new Environment();
env.setProviderUrl(url);
env.setSecurityPrincipal(username);
env.setSecurityCredentials(password);
Context ctx = env.getInitialContext();
The username and password here is the admin account. This works fine
but if i
use a non-admin account(member of Operators group), i get exceptions
on Domainloghandler
runtime
Problem: I need to register a mbean that needs to access JMS Resources.
Since
our deployment team doesnt want to provide us access to admin accounts,
we use
a "operators" group account to register our mbeans. if i do this, i get
a
Access not Allowed for subject:principals=[operator, Operators], on ResourceType:
DomainLogHandlerRuntime Action: execute Target: registerToMe.
This happens when my managed resource tries to access a JMS ConnectionFactory.
Instead if i register my mbeans using the admin account, everything is
fine and
my managed resource works nice.
This is on weblogic 81 SP1 on Solaris. Please let me know if you need
more details.
Any clues/hints/solutions greatly appreciated. There is not a lot of
documentation
on how to access/register mbeans using non-admin accounts.
TIA
Raj

A Solution for Enabling Sandbox activation by non admin users for testing (OIM 11gr2 PS2)

I just wanted to post what i came up with as a solution the the problem of not being able to Test the effects of sandbox changes for non admin level users prior to their publication. We are constantly making changes to the UI through sandboxes, the problem is rolling a sandbox back isn't easy, and we cannot be sure of the effects they will have on non administrative users until they are published, since the out of the box sandbox link isn't available to non Sysadmin level users.
To allow these non admin user accounts to test the effects of sandbox changes in our development environment, I did the following (as always, follow at your own risk):
Create and activate a new sandbox.
Close all open tabs (including the Home and Sandbox tabs) and click the "Customize" link.
Click the view -> source drop down in the upper left.
After the source is visible, click the Accessibility or Sandbox link to find the area that you will add the new "UserSandboxTest" (call it whatever you want) link.
Add a new commandImageLink directly in the panelGroupLayout: horizontal item before the "switcher" item (see the UserSandboxLink in my screen shot below):
Edit the Link you just inserted, Entering whatever you want the link to display as in your browser in the "Text" field.
Export the sandbox.
Unzip the exported sandbox and navigate to the IdmShellV2.jspx.xml (path should be: \templates\mdssys\cust\site\site).
Edit the IdmShellV2.jspx.xml file and find the new item you added in step 5.
Add the following to the commandImageLink xml item: actionListener="#{pageFlowScope.uiShell.context.launchSandboxes}" rendered="#{oimcontext.currentUser.roles['SANDBOX_USER'] != null}". Note: I used a new custom enterprise role, SANDBOX_USER, to control the display of the new link, You should substitute whatever EL conditions you need in the rendered property.
Save your IdmShellV2.jspx.xml file and zip the contents back up, just like you would for any other customization.
Import your newly edited sandbox back into the target environment.
Publish the sandbox.
This seems to work great for allowing us to test other sandbox changes effects on different types of users.

On step 10, adding the check to determine if the user should have access to the role ended up breaking access to the unauthenticated pages like the self registration page and the forgot userid/user login pages. Non-authenticated users cannot execute the method to return the role, so that fails which leaves the page not loading. To correct this I changed the rendered property to rendered="#{securityContext.authenticated}". This prevents the link from displaying on non authenticated pages, but displays for anyone else who's logged on. We only plan on using this in our development environment where no one but developers and system admins have access anyway, so it's not an issue that everyone will see the link. I wouldn't recommend putting this in an environment where end users will be logging in and testing without developing a method (or finding another way to limit the display) that can be called by unauthenticated users to prevent them from seeing the link.

Adobe Photoshop CC 2014 Crash on start-up when run as non Admin

Hi All
Having an issue with Photoshop when run as a non administrator on domain PC's.
The program crashes as soon as it loads up with the following in the event log :
Faulting application name: Photoshop.exe, version: 15.1.0.148, time stamp: 0x53d97a8f
Faulting module name: Photoshop.exe, version: 15.1.0.148, time stamp: 0x53d97a8f
Exception code: 0xc0000005
Fault offset: 0x000000000161ea23
Faulting process id: 0xdcc
Faulting application start time: 0x01cfce7cd3686a3f
Faulting application path: C:\Program Files\Adobe\Adobe Photoshop CC 2014\Photoshop.exe
Faulting module path: C:\Program Files\Adobe\Adobe Photoshop CC 2014\Photoshop.exe
Report Id: 1376e820-3a70-11e4-8f81-3417eba365e0
I don't beleive its hardware related as the same issue occurs on multiple types of hardware in multiple suites and will run fine with an administrator.
In our setup most users on the domain are non admin as well as students so its not really a poisibility to give all users of photoshop admin rights
Any help would be greatly appreciated

We are seeing this issue as well, except Photoshop CC 2014 is trying to write into C:\Shortcuts, which is the location we redirect our desktops and start menus too.
So far the only work around has been to use group policy to deploy the log file to the location Photoshop is trying to write to and set permission so all users can write to it.
I've opened a support case with Adobe (Case number: 185963856 ) however their initial response is pathetic...."We may not consider this a bug" and they sent me the locations below which "need" read/write access, which is not true and not helpful!
%temp%
C:\Program Files\Adobe*
C:\Program Files\Common Files\Adobe*
C:\Program Files\Common Files\Macrovision Shared
C:\Program Files (x86)\Adobe*
C:\Program Files (x86)\Common Files\Adobe*
C:\Program Files (x86)\Common Files\Macrovision Shared
C:\ProgramData\Adobe*
C:\ProgramData\FLEXnet
C:\Users\<user_name>\AppData\Roaming\Adobe*
C:\Users\<user_name>\AppData\Roaming\com.adobe.*
C:\Users\<user_name>\AppData\Local\Adobe*
C:\Users\<user_name>\AppData\LocalLow\Adobe*
C:\Users\<user_name>\AppData\Local\VirtualStore\Program Files\Common Files\Adobe*
~ Registry Keys ~
HKEY_LOCAL_MACHINE\SOFTWARE\Adobe
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Adobe
HKEY_LOCAL_MACHINE\SOFTWARE\Macromedia
HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Macromedia
HKEY_CURRENT_USER\Software\Adobe
HKEY_CURRENT_USER\Software\Macromedia
HKEY_CLASSES_ROOT\VirtualStore\Machine\Software\Adobe*
HKEY_CLASSES_ROOT\VirtualStore\MACHINE\SOFTWARE\Wow6432Node\Adobe*

Solution: Software Update Notifications for Non-Admin-Users

This is a follow up to [that thread|http://discussions.apple.com/thread.jspa?threadID=1642646].
Problem:
Since I'm using Mac OS X the software update notification only appears if you are logged in as an user with administrative rights. In a real multiuser environment this makes sense, because the ordinary user should not be confused with things he's not responsible for. But what about the situation with the typical single user machine, where the owner uses a non-admin account for normal work. In this case this user IS the administrator, although he's using a non-admin account. In this very common case the user should get the software update notifications as he/she can react to it. But even if "Check for updates" is selected in System Preferences, there will be no notifications. You can argue if this is a bug or not.
Solution:
I wrote a little applescript (in fact it's embedded into a launchd plist file, so you only have to care about one file), that checks once per day if there are any software updates available. If so, they are displayed in a nice looking Growl notification, if Growl is installed (highly recommended!), or in a standard system dialog. This works for any user. I'm using it for over a year now without any problems and decided to make it available to everybody. You can download it [here|http://blog.kaputtendorf.de/2009/02/22/updatecheck>.
Best regards,
Sven

good job! I also suggest you submit this to mac os x hints.
http://www.macosxhints.com/

AD RMS for multi tenant domain environment

Hi,
I have successfully configure the AD RMS with lots of work around. now i want to use multi tenant domain environment. i have multiple domains running on my production env. Now can anyone help me out to configure the RMS Server to add multiple URLs for licensing
and certifications in AD RMS Server on windows Server 2012. i need a proper step by step configuration roles to activate on immediate basis.
Any help in this regards will be highly appreciated,
Attahcments screent shots might help you what i want ;)
Regards,
Imran Bashir
MCSA 2008, MCITP, MCTS, MCP
JNCIA ER,EX
Brocade Certified
Imran Bashir Network Administrator MCP, JNCIA-EX,ER,JNIOUS +92-333-4330176

Hi,
in a single forest you can have only one RMS SCP. You could create more RMS clusters but those are not discover-able that way, only over using RMS templates or overwriting the clients registry.
If you say multi-tenant I assume every tenant should have its own RMS key, correct? If you have only one RMS cluster the cluster admin will have control over all documents.
Hope that helps,
Lutz

How to allow non-admin users to install software updates of Java, FLASH and Adobe Reader?

Hi all,
I have a company (+150 users) and I would like to allow users to update Java, FLASH and Adobe Reader only.
These software are already installed in the hosts, but there are updates of the program every week and it needs to be updated.
How can I give permissions to every user in the domain to do that? Just "Java, FLASH and Adobe Reader"
Remember that I dont want distribute software because they were installed.
I tried to enable "Enable user to patch evelated products" directive but it didn't work at my domain.
is it possible?

I have a method that works for FLASH player, but am trying to come up with a method for the other 2 myself. To automate flash player, I created a Policy and added the following:
Under Computer Config, Prefrences, Windows Setting, Files I created a new File Item.
I set Action = Replace, Created a Source File named mms.cfg* (more below) and have the destination file as systemroot%\System32\Macromed\Flash\mms.cfg (or %systemroot%\SysWOW64\Macromed\Flash\mms.cfg for x64)
I used notepad to edit the mms.cfg, and used the following in the body:
AutoUpdateDisable=0
SilentAutoUpdateEnable=1
AutoUpdateInterval=0
My non-admin users now update flash in the background silently and automatically.

IChat doesn't display OD users for non admin account

I have a Mac Mini SL server with iChat service running. When I add an Admin account (Account with admin privilege to work group manager) it can see other accounts and groups. However, when I add a non admin account it doesn't see any user nor group!
Checking the iChat logs, I can see the non admin account logging in and being authorized:
Oct 24 13:49:59 qserv jabberd/c2s[1631]: [14] [::ffff:192.168.1.29, port=50799] connect
Oct 24 13:49:59 qserv jabberd/c2s[1631]: [14] SASL authentication succeeded: mechanism=DIGEST-MD5; authzid=[email protected], TLS negotiated
Oct 24 13:49:59 qserv jabberd/c2s[1631]: odauth_check_servicemembership: checking user "user" access for service "chat"
Oct 24 13:49:59 qserv jabberd/c2s[1631]: odauth_check_servicemembership: mbrcheck_servicemembership returned 0
Oct 24 13:49:59 qserv jabberd/c2s[1631]: odauth_check_servicemembership: user "user" is authorized to access service "chat"
Oct 24 13:49:59 qserv jabberd/c2s[1631]: [14] bound: jid=[email protected]/Luminous
Oct 24 13:49:59 qserv jabberd/sm[1629]: session started: jid=[email protected]/Luminous
All clients are Mac OS X 10.6

Tim Harris wrote:
odauth_check_servicemembership: user "user" is authorized to access service "chat"
This means that this user is not allowed to use the iChat services. In sever admin - access, you get to set who or what type of users / group, etc is allowed access to which services. Did you check that?
Unfortunately I don't see that! I'm using Server Admin 10.6.3 and when I click on the iChat service it displays three tabs only; Overview, Logs, Settings where settings has two sub tabs (General and Logging).
There isn't any option where I can define whom can or cannot access iChat service in Server Admin.
Under the Setting's General tab I have:
Host domains set to: qserv.xxx.net
I also have my SSL Certificate selected
Authentication: Any method
Enable XMPP server-to-server federation is not checked

Trust ALL root Certifications in Windows not working for non-Admins on Terminal Server

I have been trying to setup a verification process that will allow us to us Active Directory Certifications to verify signatures. I have finally found the setting to use the Windows Store after not getting Adobe to query our Certificate Authority. It works great on our local desktop where users have Admin access, but when users do it on our Terminal Server it does not allow it. I thought the issue was access to a configuration file in the Adobe directory, but I found the setting in the Registry set correctly. But does not work correctly. One additional note is I had noticed that after I enabled it on a Non-Admin, is Adobe would say it crashed after I shut it down.
My question is what type of privilege do you need, or maybe Adobe need to access the Windows Cert Store from a Terminal Server with a non-Admin because it is not validating after confirming the Setting is enabled.
Thanks,
Donavan

hello, since version 26 firefox is able to auto-update on windows even for non-admin users (when the mozilla maintenance service is getting installed in the original configuration): http://www.mozilla.org/en-US/firefox/26.0/releasenotes/#whatsnew
those would be the auto-updates provided by mozilla directly - so i'm not sure if this is something that would fit in your environment. installing the .exe file of a new version (available at [https://www.mozilla.org/firefox/all/]) on top of an older version will also update the program.

Will Firefox be configured to update for non-admins on windows 7/8

We are considering allowing Firefox in our 5000 user hospital and are currently all Internet Exploder. None of our users are admins on the hospital systems so, is it possible to push updates to windows 7/8 systems? I am not looking for help doing the push, just wanting to know if the updates available for download as MSI or EXE?

hello, since version 26 firefox is able to auto-update on windows even for non-admin users (when the mozilla maintenance service is getting installed in the original configuration): http://www.mozilla.org/en-US/firefox/26.0/releasenotes/#whatsnew
those would be the auto-updates provided by mozilla directly - so i'm not sure if this is something that would fit in your environment. installing the .exe file of a new version (available at [https://www.mozilla.org/firefox/all/]) on top of an older version will also update the program.

Non admin in a domain environment

Similar Messages

Maybe you are looking for