How do I grant a local user account the permission to add other local users in Windows 7 Professional? The important point is, that the local user who should be able to create new accounts must not have admin privileges.
I didn't find a local group policy to grant permission to create users to a specific account. So I tried creating the users via a PowerShell-Script:
$user = Read-Host "Please enter username" $objOu = [ADSI]"WinNT://$env:computername" $objUser = $objOu.Create("User", $user) $objUser.setPassword("DefaultS3cr3t") $objUser.setInfo() $objUser.description = "Simple User" $objUser.passwordExpired = 1 $objUser.setInfo() $group = [ADSI]"WinNT://$env:computername/Users,group" $group.Add("WinNT://$user,user")
When I run this script with administrative privileges, it works as expected.
To give a normal user the permission to execute this script, without leaking the admin password, I tried to use an "escrow agent" as described here: http://powershell.com/cs/blogs/tobias/archive/2010/10/28/regular-users-running-admin-scripts-safe.aspx
The problem is, that the task is executed in background (because it is executed as a user that is not logged in), so the username cannot be entered.
Using a "SecureString" to save the password isn't an option, because the adminpassword would be extractable for the normal user.
Is there a way to grant a normal user permission to create other normal users, without granting full administrative privileges?