Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

How do I grant a local user account the permission to add other local users in Windows 7 Professional? The important point is, that the local user who should be able to create new accounts must not have admin privileges.

I didn't find a local group policy to grant permission to create users to a specific account. So I tried creating the users via a PowerShell-Script:

$user = Read-Host "Please enter username"

$objOu = [ADSI]"WinNT://$env:computername"
$objUser = $objOu.Create("User", $user)
$objUser.setPassword("DefaultS3cr3t")
$objUser.setInfo()
$objUser.description = "Simple User"
$objUser.passwordExpired = 1
$objUser.setInfo()

$group = [ADSI]"WinNT://$env:computername/Users,group"
$group.Add("WinNT://$user,user")

When I run this script with administrative privileges, it works as expected.

To give a normal user the permission to execute this script, without leaking the admin password, I tried to use an "escrow agent" as described here: http://powershell.com/cs/blogs/tobias/archive/2010/10/28/regular-users-running-admin-scripts-safe.aspx

The problem is, that the task is executed in background (because it is executed as a user that is not logged in), so the username cannot be entered.

Using a "SecureString" to save the password isn't an option, because the adminpassword would be extractable for the normal user.

Is there a way to grant a normal user permission to create other normal users, without granting full administrative privileges?

share|improve this question
add comment

2 Answers 2

In order to add local accounts, the account you are using needs to have administrative rights on that local machine. So unfortunately, it can't be delegated to a normal (or even PowerUser) account. Even if you utilized Active Directory, you'd still have to give the object local admin rights.

share|improve this answer
    
I was afraid that there is no policy to grant a local account the permission to create other local accounts. That's why I tried to use the escrow agent or would like to use something like a background service. –  MichA Jun 11 '13 at 5:08
add comment
up vote 0 down vote accepted

I came to the result, that using a two-staged powershell script solves my problem. I wrote a service script, that gets launched by the windows task scheduler with full administrative privileges as described in this link: http://powershell.com/cs/blogs/tobias/archive/2010/10/28/regular-users-running-admin-scripts-safe.aspx

The service task then opens a named pipe and listens for a client connection. The pipe is secured by its ACL, so that only the creating user and the local user account, that should be able to create local users, can read / write it. I developed a simple clear-text protocol to list and add users. The service script does the work of adding users and the frontend is only to list the users and invoke the "add" command.

Both scripts are further secured by restrictive file system permissions to prevent modification.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.