User account with rights for install SW on any domain PC without RDP rights?

[VTT_Vulcan]

Hello everyone,

Hope you're doing well. Is any chance assign rights to one user, who could install SW on any domain PC as administrator? But without RDP rights or any access to servers.

This can be solved with local admin on PCs, but this isn't ideal solution. I need assign or remove this user at any time quickly and easy.

I tried groups "Key Admins" and "Enterprise Admin" but without positive success.

I use Windows Server 2016.

Could you please help me in this issue.

Thank you very much.

[#2]

@VTT_Vulcan Local Admin is probably the easiest method as it sounds like you have already discovered. If you wish to more easily add/remove users from a local group I've found the best way to accomplish this is by using group policy. You would need to create a new domain security group and a new group policy object (or use existing, your preference). In the policy you can add the domain SG as a member of the "Administrators" local group. (this would be under restricted groups)

By doing this you can easily add/remove people from a domain group which in turn will add/remove the permissions from the local "Administrators" group of wherever the policy is applied. Keep in mind however that members of local admins will have the ability to RDP by default. If this is a deal breaker you will need to find an alternate method.