Member Avatar for Ishtiaq_1

How can I allow a non administrator domain user account to enable/disable network adapter.

I have many users in my company domain named as mycompany.org who are using Dell laptop with windows 7 professional. I am using Windows Server 2008 R2 as domain controller. On priority, my users need to enable / disable network adapter (its my organization requirement), but currently the system denies them this privilege without an administrator password. A prompt display every time to provide credentials. Is there a way to give them permission to enable / disable network adapter without any prompt. Step that I have already taken are:-

  1. My domain user named as student13 (with Window 7 professional installed in a laptop) is added in a group Network Configuration operator in Domain controller.

  2. In domain controller a GPO has been configured as:-
    Ability to enable/disable a LAN Connection  Enable

  3. The created GPO above linked to an OU that have the users who needs to enable / disable network adapter.

I believe what i need to do is make sure that my users should be the part of the Network Configuration Operators Group. This group enables my users to delegate the privileges that can manage the configuration of networking features.

I have done all the possible solutions but still my users face a problem to enable disable network adapter. A screen prompts to provide credentials appear every time. Kindly help me out.
Thanks!

  • 3 Contributors
  • 4 Replies
  • 1K Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by Ishtiaq_1

Dani AI

Generated

Short answer: the missing piece is scope — membership must exist on each laptop (the LOCAL "Network Configuration Operators" group) and the group membership must be applied by a Computer-side policy, not only by adding accounts at the domain controller or linking a user-side GPO. Adding people to a domain-level group on the DC does not automatically make them members of the local group on every workstation. you already enabled the policy and added accounts at the DC, but the client machines still need the local-group change applied to their computer objects. is right that making everyone a local admin works, but that is over-broad. 's service idea is valid for more complex workflows; below are simpler, manageable options.

Practical, low-risk approach: create a domain security group (for example NetCfgOps), add your users, then deploy that group into each workstation's local "Network Configuration Operators" via Group Policy Preferences. Configure a GPO linked to the OU that contains the computer accounts, go to Computer Configuration -> Preferences -> Control Panel Settings -> Local Users and Groups -> New (Local Group) -> Action=Update -> choose "Network Configuration Operators (built-in)" and add your domain group as a member. Target the GPO to the machines you want, run gpupdate /force (or reboot) and verify with gpresult /h or lusrmgr.msc on a client.

If your VBScript still prompts (it likely needs an elevated token to change device state), deploy a privileged scheduled task or a small service to run the enable/disable operation as SYSTEM or a managed service account, grant ordinary users permission to start that task, and give them a desktop shortcut that runs schtasks /Run /TN "ToggleNetTask". Test on a pilot group, keep membership limited to a domain group for easy revocation, and avoid blanket local-admin rights.

Recommended Answers

All 4 Replies

Member Avatar for rubberman

The principal user of a computer should (under most circumstances) be a member of the Administrator group for that PC (only) so they can do these things without a lot of futzing around.

Member Avatar for Ishtiaq_1

Dear thanks for your good guidence but still the problem is in hand

Member Avatar for rproffitt

"You're a programmer, Ishtiaq_1 !"

  • Hagrid.

Anyhow you could write a service that you send a message to and it does this for you on demand.
https://www.google.com/search?q=command+line+to+disable+a+device&ie=utf-8&oe=utf-8 finds it can be done via a command line so you as a programmer would craft a service that checks for say a message on schedule or event (your choice) and does the deed. That service would be given the rights to do that.

Such a large company must have a few programmers laying about.

Member Avatar for Ishtiaq_1

You are rigth dear but my company need a scripts which shortcut would be available on every desktop to enable or disable network adapter only. i program a vb script it all works but when it executed a prompt appear that need administrative credentials. if i manually click on network adapter to disable or enable it again prompt me to provide password. is there any solution to permitt domain user to do such specific task. i have done all the steps which are mentioned in my question above.

Thanks

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.