Hello We run windows server 2008 as our DC. Our users run Windows 7 professional/enterprise 86/64. Our accounting department runs an executable from cd-rom. Unfortunately everytime they need to run the executable they have to call help desk for someone to remote to their system and provide admin credentials to run the executable. I've done considerable research regarding the issue. The only option I see is to leverage a GPO on the DC. Am I on the right track? Which rule in GPO should I modify? Thank You.

Yes! you can setup a new GPO on the OU where these users are created. Use GPMC to create new GPO and link it to the user's OU then edit it and navigate to this location in the console tree: Group Policy Object - Computer Configuration or User/Configuration/Windows Settings/Security Settings/Software Restriction Policies Computer Configuration/Administrative Templates/Windows Components/Windows InstallerSachin Gadhave MCP, MCSA, MCTS

Hello, for GPO questions please use the following forum http://social.technet.microsoft.com/Forums/en/winserverGP/threadsBest regards Meinolf Weber MVP, MCP, MCTS Microsoft MVP - Directory Services My Blog: http://msmvps.com/blogs/mweber/ Disclaimer: This posting is provided AS IS with no warranties or guarantees and confers no rights.

I don't know if there's a way to do this via GPO, but one option would be to create a shortcut to that application using the runas command with the /savecred switch for an administrator account. You then still need to manually run it and enter that users password the first time, but from then on your users will be able to run it without prompting. That way your users can run the app, but you don't need to give them elevated permissions to anything else. There's a discussion of the command and some of its options here : http://social.technet.microsoft.com/Forums/en-US/itprovistasecurity/thread/cbb27586-f0eb-446d-a777-fc1889b5c63d

Yes! you can setup a new GPO on the OU where these users are created. Use GPMC to create new GPO and link it to the user's OU then edit it and navigate to this location in the console tree: Group Policy Object - Computer Configuration or User/Configuration/Windows Settings/Security Settings/Software Restriction Policies Computer Configuration/Administrative Templates/Windows Components/Windows InstallerSachin Gadhave MCP, MCSA, MCTS

Hello I tried the settings but it did not change anything. Everytime a domain user tries to run an executable from the cdrom drive it will ask for credentials. Maybe there is a detailed example of the solution you provided. Thank You