Help elevating limited user status for admin purposes

[Taylor]

I'm trying to figure out a way to get past the problem we have on our
network of giving all users local admin rights.

The problem is that we get called to users desks to fix issues and its
often a huge pain to make a simple change to a printer setting or a
driver when the user does not have admin rights. So in the past we've
just given users admin rights, but this presents an even bigger
problem of "I'm gonna install smileysearchbarp0rn for fun."

We want to restrict users to a limited account such as user or power
user, but we would like to come to their desk, push a magic button,
temporarily elevate to admin rights over top their profile do our
changes, and demote them back to a limited account.

Is this possible without having them close all their programs, log
out, log in as administrator, fix a printer issue, or an Internet
Explorer issue and then log back out and back in to test?

Thanks,
--Taylor

 

[Colin Nash [MVP]]

I'm trying to figure out a way to get past the problem we have on our
network of giving all users local admin rights.

The problem is that we get called to users desks to fix issues and its
often a huge pain to make a simple change to a printer setting or a
driver when the user does not have admin rights. So in the past we've
just given users admin rights, but this presents an even bigger
problem of "I'm gonna install smileysearchbarp0rn for fun."

We want to restrict users to a limited account such as user or power
user, but we would like to come to their desk, push a magic button,
temporarily elevate to admin rights over top their profile do our
changes, and demote them back to a limited account.

Is this possible without having them close all their programs, log
out, log in as administrator, fix a printer issue, or an Internet
Explorer issue and then log back out and back in to test?

Thanks,
--Taylor

If you promote the user to admin (you could, for example, do this remotely
by connecting to the machine using the Computer Management MMC and adding
them to the local admin group), they still need to log out and back in for
it to take effect.

You can try the "Run As" command, to run whatever utility you want to...
http://support.microsoft.com/default.aspx?scid=kb;en-us;305780&sd=tech -- it
can get a bit awkward trying to use Run As to run the Control Panel (aka
control.exe), but it should be possible...

 

[Guest]

Taylor:

What if you had a local policy setting that restricts the users' abilities
to install programs, modify settings etc? Then, when they have a problem:
You walk to their desk (or efficiently use a remote control solution). Deny
them "read" access to this local policy. Refresh the local policy settings,
which would unlock the user. Then just change it back after making
corrections. This can be done using a "magic" button in the form of a batch
file. This can also be accomplished remotely.

Good luck.

Joe