1

I have a situation for a user which is not in a corporate LAN. The user is a small business with a home computer. To prevent other members of the user's family from installing malware, games, or other unwanted software if they use the computer, the user's regular account is not a local administrator. When the user needs an upgrade, he has someone come and do remote support. The support person has the admin account password, and enters it for the user when UAC prompts for it.

The user has a program which takes content updates every now and then. For this program, it would be great if the user could install on his own from the publisher. All of the official software updates can be downloaded from a website and then installed from an an exe (may be MSI, need to check).

The ideal situation would be that the user can download these updates and install without needing the admin password for anything from this publisher. This balances the risk of letting the user install stuff on his own without needing the effort of a remote tech each time.

Since the user is not on a corporate lan, packing and remote install option are not a good fit because they would take just as much time as remotting in and typing the password.

Is there anyway to whitelist the publisher so that UAC does not prompt for this publisher, but for anything else the admin password would still be needed?

  • So they spend hundreds of dollars for this support but don't spend the hundreds of dollars for a family PC? Just don't give people access to your business PC. You can setup Windows to only allow specific applications to run, they don't need a third-party, to mange it. – Ramhound Feb 19 '16 at 1:46
  • Local Group Policy should allow you to configure that. It is easily broken, if a user who should not have administrator access, is given admin access – Ramhound Feb 19 '16 at 1:54
  • @Ramhound To clarify, its not about allowing applications to run, its about allowing the installation of software that will run in user mode. While your first response asks a nice philosophical question, those are parameters which cannot be changed. There is either a technical solution or not. Do you have any references to clarify your point on Local Group Policy, the user should not be made an admin, I am not aware of any policy setting for white listing a publisher. – Eric G Feb 19 '16 at 4:11
  • you can have multiple users, one can be Superuser, but still has limits. You can install programs for one. Whitelisting applications that might be installed would prevent abuse – Ramhound Feb 19 '16 at 13:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.