SETI: DASM Lost Domain Admin rights!!!!

[BofRA]

OK we got a new Ensign that is running the IT department. He did an audit of who has domain admin access and decided only those people in the actual IT division get it. So the "remote" admins only get local admin rights. He doesn't have a problem with me running seti but he won't budge on the admin rights issue.

So my question is :

Is there a way to make any of the lan installs work with local admin rights? As far as I know they all assume domain admin rights. It has become really cumbersome to go from office to office and install.

Come on guys lets put some heads together and crunch this problem!!!!

 

[dxkj]

If he is ok with it, cant he install it for you using his rights?

 

[BofRA]

I tried this but he is "busy" and doesn't want to be bothered with it. Classic case of Officer vs Enlisted in the Armed Forces!

 

[dxkj]

doh. how many computers are there? I went around and installed the service on about 85 computers manually so far. Fits on a floppy, installs in 10-15 seconds... didnt take too long

 

[Assimilator1]

Well to be fair ,its not running for him so you can't blame him for not getting involved ,at least he allows you to run it

Afraid I don't have an answer to your problem.......unless somehow he can give you customised rights to allow you to install just SETI remotely??

 

[BofRA]

Originally posted by: dxkj
doh. how many computers are there? I went around and installed the service on about 85 computers manually so far. Fits on a floppy, installs in 10-15 seconds... didnt take too long

I have done this with about 35 computers so far, but the problem is getting in to all of the offices and getting on the computers when not in use. Not to mention I am talking hundreds of computers!

 

[IsOs]

I hate to burst your bubbles but the Ensign who told you he doesn't mind seing SETI in there is probably not the officer that has the right to say so.

I hope they are not security sensitive computers. You'll never know what kind of problem may arise from the use of such computers.

 

[winr]

Hi ReaganCRW.
What ship are you on?
The Ronald Reagan?
I saw a beanie baby bear dressed up as a Sailor with "RONALD REAGAN" badge.
I thought you might like it.

 

[Smoke]

Bryan,

I think dxkj's suggestion may be the only way to go. Just do your best ... I'm really proud of your efforts.

Mainly, stay safe.

 

[conjur]

Why would you need domain admin access to install on the PCs? What is the domain? NT 4? W2K (Active Directory)?

Wouldn't a user with access to the workstations' Power User or Administrator group be acceptable?

I can understand locking down the Domain Admin access but a new group could be setup with admin access on workstations and you could use a logon that's a member of that new group.

 

[RaySun2Be]

Conjur, I think he was wanting to use a batch installer like the FlexInstaller, which works best if you have domain admin rights.

 

[Crazee]

Does the IT department use any software delivery systems like LANdesk or CA Unicenter? If so you can deliver and run with local admin rights using those deployment tools, you do not have to have domain admin rights.

 

[SoulAssassin]

We use a domain 'workstation admin' group at work that is included by default in the image for all workstations. It's in the local admin group so this gives desktop admins full access to the pc's but not to the domain. Might want to see if you can work something similar.

 

[Mardeth]

If the boss cant help you why dont you ask the other IT guys? Also you could ask if he could give you a temporary domain thingy so you could install them. You have had it before so it shouldnt be too hard to get.

 

[blcjr]

Would this work?

There is a great set of free tools at www.systernals.com, including PSEXEC, which will execute processes remotely. You can specify the account and password the process is to run under. Though I've never tried using the local machine admin account, I don't see why it wouldn't work.

-baz

 

[conjur]

Originally posted by: RaySun2Be
Conjur, I think he was wanting to use a batch installer like the FlexInstaller, which works best if you have domain admin rights.

Wouldn't the FlexInstaller just require local workstation admin rights? As long as the workstations are member PCs in the domain and he uses an account with local admin rights, should work fine.

Domain Admin is solely for the maintenance of user accounts/group policies, not for local workstation administration.