Domain user right to run executable

hello

we run windows server 2008 our dc. our users run windows 7 professional/enterprise 86/64. our accounting department runs executable cd-rom. unfortunately everytime need run executable have call desk remote system , provide admin credentials run executable. i've done considerable research regarding issue. option see leverage gpo on dc.

am on right track? rule in gpo should modify?

thank you.

 

> when set rule (execuatable) specific domain user rule

> deny installatin rights other specific user.

> when specific user runs executable user prompted

> administrator credentials.

>

 

check executable manifest:

 

open exe in editor of choice (notepad sufficient,

slow large files), search "requestedprivileges".

should find similar to

 

<trustinfo xmlns="urn:schemas-microsoft-com:asm.v3">

<security>

<requestedprivileges>

<requestedexecutionlevel

                level="highestavailable"

                uiaccess="false"

            />

</requestedprivileges>

</security>

</trustinfo>

 

if "level" contains "requireadministrator", you're out of luck

- application developer decided application needs admin

credentials under circumstances...

 

regards, martin

 

---

no not evil, if know doing: or bad gpos?
wenn meine antwort hilfreich war, freue ich mich über eine bewertung! if answer helpful, i'm glad rating!

Windows Server  >  Group Policy