Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I’m managing a small network of computers running Windows 7, of which I have set end-users with limited permissions (non-admins). For security reasons I want the end-users to be able to update applications like Adobe Flash/Reader, Java, and Safari/Quicktime without the need of having admin access on the computer.

My initial idea was to create a scheduled task on the system that would run with full administrator permissions. The scheduled task’s action would be to call the update executable programs. Like:

Apple Safari/Quicktime

"C:\Program Files\Apple Software Update\SoftwareUpdate.exe -task"

Adobe CS/Reader9

"C:\Program Files\Common Files\Adobe\Updater6\Adobe_Updater.exe"

Adobe Flash

C:\Windows\System32\Macromed\Flash\FlashUtil11c_Plugin.exe -update plugin

Java

"C:\Program Files\Common Files\Java\Java Update\jucheck.exe"

The problem when scheduling the task is that when it gets triggered, the limited end-user is not able to see the update dialog boxes. The scheduled task works perfectly when the administrator account is logged in, but not whenever the limited end-user is logged in, this completely defeats the purpose of having to schedule a task with full administrative permissions, since the limited end-user is not able to see if the scheduled task has happened.

Does anyone have any recommendations to the admin level scheduled task limited when a limited user is logged in? Or better yet, a different approach on having the non-admin users be able to update the applications.

share|improve this question

Ahhh, Third Party Patch Management. Makes you appreciate MSI files.

Technically you can't. To update a program, you need write access to the program files. To modify these files, you'll need Admin access. So really, you can't give them write access and not call it Admin privileges.

I suggest turning off the Update services and just downloading Adobe's unattended installers. Same for the Java installers.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .