Let users install software without local administrator rights on domain

Question

I manage the network of a small company. As I'm not always in the office it is a wish from the employees to be able to install software without having to go to me. My predecessor set it up that everybody is a member of the local administrator group trough GPO. Now one of my colleagues had an external HDD which the system didn't recognize and ended up creating a RAID1 trough the Intel Rapid Storage, so destroying all data on D:. Apparently some of my colleagues are best of with as little right as possible.

How can I let them install software without giving them administrator rights? We use SBS2011.

Solution

Most software installation programs for Windows require Administrator rights to function properly. This is an artifact of the design (or lack thereof, some might say) of the Windows platform. While there is an increasing trend toward software that installs only within the writable directories accessible to a limited (i.e. non-Administrator) user (things like ClickOnce installs), the vast majority of software installers don't work that way.

There's nothing that you can practically do to accomplish what you're asking for. Anybody who tells you otherwise is either lying to you or doesn't know what they're talking about.

The single best thing an IT administrator overseeing client computer operations in a Windows environment can do to increase reliability and security is to insure that users have non-Administrator access to the client computers. Nothing has a better "payoff" than making this change. No "protection" software, Group Policy, or any other method that attempts to both grant Administrator rights and somehow limit what users do with those rights is a substitute.

Comments

[Shadur]

I'm sorry, I can't read this question without going into screaming flashbacks around 'everybody is a member of the local administrator group'...

[Admin]

Sorry but the questión is little bit strange. Administrator rigths were invented to make sure that only an administrator change the system. An instalation is a system change. If you want that no one damage the system of their computers you need to remove administrator rigths to your colleagues. System changes should not hapen every day.A system needs to be planed to install all software needed at once.

[Matthieu]

Will take your word for it. Probably have some work to do in convincing the employees they don't need administrator rights. At least the ones who are not so good with computers.