Network Admin Locking Feature - IT administrators

[David]

Guys,

does anyone know of some kind of software platform that will allow us to lockdown all user profiles (i.e set them all as users, with no privilieges) and then when an admin wants to do some installations etc etc on their machine, they can unlock the admin features by entering a password or something?

I know of the run as command but i'd like something more comprehensive. Any ideas anyone? cheers lads.

 

[KDF]

"run as" and remote management gets me by. I did research this in the past and ultimately found that even the solutions available was not comprehensive.

For example if I wanted to install software as a normal user but enter and admin password it would then install the software as the admin user.. stupid winblows, in linux I can just su as another user without having to know their password.

 

[young_lew]

Do you not just lock down computer features in a policy, and then NOT apply that policy to yourself?

so that when you login you have free reign.........

 

[KDF]

I think he means without logging the user off, or at least that was my take on it.

Otherwise it would just be a simple admin/user account deal..

 

[The Hoff]

Indeed, the only times this is useful are the times you don't want to log the user off - i.e remote working via Citrix or similar.

No real workaround for it that I know of, looking at some solutions now and as I type am installing Scriptlogic Desktop Authority onto my test domain, looks good from what I can see and we already use their Helpdesk software which works nicely.

 

[Andy.]

I just open IE6 as local admin on the remote machine and you can navigate around and do whatever you like without logging the user out. The downside is that it doesn't work with IE7.

 

[ChrisR]

I just open IE6 as local admin on the remote machine and you can navigate around and do whatever you like without logging the user out. The downside is that it doesn't work with IE7.

heh what I do when I'm being really lazy, although don't use my admin account rather than local admin so I can get to the network shares

As for installing software, if you're big enough to justify the costs use SMS/SCCM, don't even need to go near the pc physically or over remote (I'm a little bias though when it comes to software distribution stuff ) Then their accounts can be left locked down and you can push software out as you please.

 

[The Hoff]

SMS2003 was great, but I personally hate SCCM.

 

[KDF]

I just open IE6 as local admin on the remote machine and you can navigate around and do whatever you like without logging the user out. The downside is that it doesn't work with IE7.

heh what I do when I'm being really lazy, although don't use my admin account rather than local admin so I can get to the network shares

As for installing software, if you're big enough to justify the costs use SMS/SCCM, don't even need to go near the pc physically or over remote (I'm a little bias though when it comes to software distribution stuff ) Then their accounts can be left locked down and you can push software out as you please.

All our software gets pushed out by group policy on AD. But its a pain as you can only use MSI's or you have to repackage. How you find SMS for distributing those more obscure packages ?

 

[ChrisR]

SMS2003 was great, but I personally hate SCCM.

I've not really looked into it much yet, planned in for the end of the year. Hoping it doesn't wreck what SMS did too much

All our software gets pushed out by group policy on AD. But its a pain as you can only use MSI's or you have to repackage. How you find SMS for distributing those more obscure packages ?

It's easy peasy I hate people who are 'repackage' mad, half the time there's really no need to change the vendor installer as such. If you have SMS then you are 'allowed' to use the SMS installer utility from MS. It's a bit old but I find it does everything I need and haven't had a piece of software I haven't been able to push out silently yet.

I had a bash with things like wise package studio but I wasn't impressed so went back to the freebie MS tool If I ever need to do any msi editing I just crack out Orca.

 

[The Hoff]

www.appdeploy.com

Great site for repackaging information

 

[ChrisR]

www.appdeploy.com

Great site for repackaging information

Yeah if I get stuck with something it's always worth a visit Some of the info in their package db thing is a bit misleading, and sometimes just wrong, but not very often at all

It's funny reading some of the forum posts, people really do make a meal of packaging and try to be way to clever for their own good. Keeping everything nice and simple is the best way to keep everything working