We have Windows 2003 Domain network, in this we have multiple Windows 2003 and 2008 R2 SP1 Servers, Question is Developers need access to the servers for installing the applications, currently we are giving temporary admin rights to the servers for the developers before the application go live, but we like to restrict giving admin access to the developers and do the following tasks 1) Login to the servers 2) Install application to the servers 3) Troubleshoot the application on the servers 4) Work on IIS Applications and web applications like IBM Websphere and etc.. 5) Can we use the Power users group for all this purposes 6) Restrict base application installations like Office, Adobe, Java, applications to the server please provide an answer to this questions, your help is much apprieciated Thank you Sathish Kumar DSathish Kumar

Hello, for IIS questions, post in http://forums.iis.net/ forums. For your applications, contact your application vendor Technical Support. To software install restriction, have a look to this Microsoft article about Software Restriction Policies via group policies: http://technet.microsoft.com/en-us/library/bb457006.aspx This posting is provided "AS IS" with no warranties or guarantees , and confers no rights. Microsoft Student Partner Microsoft Certified Professional Microsoft Certified Systems Administrator: Security Microsoft Certified Systems Engineer: Security Microsoft Certified Technology Specialist: Windows Server 2008 Active Directory, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Network Infrastructure, Configuration Microsoft Certified Technology Specialist: Windows Server 2008 Applications Infrastructure, Configuration

I am looking restricting the admin rights to the developers, please help me on thisSathish Kumar

Hello, you can't restrict them that detailed you like to do. Better create for your developers a test server where they can do what they need. I know from other company admins they have even a child domain or another ddomain tree within the forest for the developers and if everything is working as expected the solutions are implemented to the production domain, which seems the better option for you.Best regards Meinolf Weber Disclaimer: This posting is provided "AS IS" with no warranties or guarantees , and confers no rights.

Hi, It's not recommended to grant domain admin permission to developers, if they have only local admin on member server, you can try the following one. Using Software Restriction Policies to Protect Against Unauthorized Software http://technet.microsoft.com/en-us/library/bb457006.aspx BrentPlease remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.