Best Practice security group for software installation

Craig Garland 286 Reputation points
2020-11-06T00:40:29.14+00:00

Hi Guys,

I am trying to find the best secure way to deploy multiple applications. I was expecting I could create a user resource account to deploy the software to desktop / severs. I would have through that there would be a domain security group for this but I cannot find one. Most people indicate they create an account and add it to the local administrators group. Yet if you are pushing it to all computer why not just make it a domain account, then block the rights to logon locally, or make it a local admin and then block logon locally.

I would like to hear what people think is the best secure method? Whether you have to have Admin rights to install an application? Please note that a Group Policy installation will not work as we would like to push application from a deployment package.

Thanks for your time.

Craig

Windows 10 Security
Windows 10 Security
Windows 10: A Microsoft operating system that runs on personal computers and tablets.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
2,754 questions
Windows Server Security
Windows Server Security
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
1,721 questions
0 comments
Accepted answer
  1. Hannah Xiong 6,231 Reputation points
    2020-11-06T06:00:13.03+00:00

    Hello,

    Thank you so much for posting here.

    According to our description, we will not use Group Policy to install the software. Usually we could use this Group Policy to automatically distribute programs to client computers or users.

    As per my understanding, we would like to create a user account (with no admin rights)to be able to install the software. Whether it needs admin rights or not depends on the applications. According to my research, the most suggestion is to add an AD security group to the local administrators group.

    Reference:

    https://community.spiceworks.com/topic/1550449-how-to-give-install-rights-for-selected-softwares-with-no-local-admin-rights

    https://community.spiceworks.com/topic/128551-security-group-in-ad-to-that-gives-users-permission-to-install-software

    Best regards,
    Hannah Xiong

    ============================================

    If the Answer is helpful, please click "Accept Answer" and upvote it.
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Craig Garland 286 Reputation points
    2020-11-09T02:04:47.97+00:00

    Hi,

    After reviewing your message, I have decided that the best option is to create a standard domain account. Give it local admin rights on each desktop. (Push with group policy.) We will also block the account from log on locally which in increase protection and reduce the chance of the account being compromised.

    It looks like an account needs to be administrator to install software, unless that is a user only based application.

    Thanks
    Craig

    0 comments