Hello,

I have AD domain and 100 users, 15 of them are developers.
Developers need full control over their machines. They need to
install software they need without administrator perticipation.

I do not want to add them to Domain Admins group, however
adding them to local Administrators group on their PCs doesn't
solve the problem.

I heard there is a way to modify permissions on some special registry
hives and system folders (Program Files and %SystemRoot%), creating
a domain group, let's say, SoftwareInstallers and assign these permissions
to this group.

Is there a better way to do that? Or, anyway... what should I do to
make it work?

Thanks in advance

Hi Cary
Adding the users domain user account to the local administrator group on
the PC should allow them to install any software? If it does not you way
want to look at the permissions on the box to see if they have been changed
from the defaults. You can use filemon and regmon from
www.sysinternals.com to find out what registry or files are giving you an
access denied error when they try to install the application.

Hope this helps


M. Scott Sanders

MCSE, MCSA, MCP+I
Microsoft Enterprise Support
EPS Directory Services Team
Email: (E-Mail Removed)

This posting is provided "AS IS" with no warranties, and confers no rights.