Delegate software install/uninstall power to users/groups

Question

I would like to have support personnel install and uninstall software across the domain, with no less and no more admininstrative capabilities. How do I do so?

Solution

You can't.

You have a few options:

1. Make users that need to install software (like tech staff) local administrators on client computers. They don't need Domain Admin for this. Use GPP or Restricted Groups in GPO to do this.

2. Use self-service install options like Group Policy Software Distribution Publishing, where users can add published programs themselves through Add/Remove programs in the control panel. Or use the SCCM 2012 Software Catalog feature, which accomplishes a similar result with more flexibility.

3. Push software down yourself, so that you don't even need the tech staff to go install it. This is the best, but most complicated way. SCCM, Altiris, LanDesk, and other configuration management systems are what you would use to accomplish this.

Comments

[Greg Askew]

Run any program that could potentially do anything and require any and all privileges? Far too broad.

[Oxwivi]

@GregAskew Yes, and only for a targeted group, as I have mentioned.