SOE for remote mobile users

[SOE]

Hi,
we are in the process of reviewing SOE of laptops for those remote mobile
users in the company.
One thing we have to decide is whether to put the user in the local admin
group.
We wish to limit the privileges the user has so that they can't install
unauthorized softwaare. But we may still allow them to install printers and
install windows updates which may still need locl admin privilege. I am also
wondering whether outlook needs local admin privilege to fully function (?).
Any suggestions?
Thanks in advance

 

[Lanwench [MVP - Exchange]]

In

Hi,
we are in the process of reviewing SOE of laptops for those remote
mobile users in the company.
One thing we have to decide is whether to put the user in the local
admin group.
We wish to limit the privileges the user has so that they can't
install unauthorized softwaare. But we may still allow them to
install printers and install windows updates which may still need
locl admin privilege. I am also wondering whether outlook needs local
admin privilege to fully function (?). Any suggestions?
Thanks in advance

Outlook doesn't need local admin rights. As far as printers go, and Windows
Updates - yes, local admin rights are needed. I've never tried to tweak WU
to run under a limited user account, but I've tried (in vain) to allow
limited users to install printers, so I generally sigh and grant local admin
rights when I have to, and warn the users to be vewy vewy careful.

 

[SOE]

Thanks Lanwench,
So the conclusin is - if I want to allow the user to install printer and
windows updates I'd have to add them into the local admin group. Right?
In such a situation, is there a way to restrict them to install other
software?

"Lanwench [MVP - Exchange]"

 

[Lanwench [MVP - Exchange]]

In

Thanks Lanwench,
So the conclusin is - if I want to allow the user to install printer
and windows updates I'd have to add them into the local admin group.
Right?

That's the only way I've ever found to do it, yes.

In such a situation, is there a way to restrict them to install other
software?

Nope. Other than threatening them with grievous bodily harm if they change
anything you don't want them to change.

"Lanwench [MVP - Exchange]"

In

Outlook doesn't need local admin rights. As far as printers go, and
Windows Updates - yes, local admin rights are needed. I've never
tried to tweak WU to run under a limited user account, but I've
tried (in vain) to allow limited users to install printers, so I
generally sigh and grant local admin rights when I have to, and warn
the users to be vewy vewy careful.