We need to give local admin privileges on most workstations to our ERP software admin so he can install updates. He is not a domain admin, simply a domain user. However, we don't want him to have local admin rights to any management computers, just staff. How do we correctly proceed?

  • What is the ERP software? Why does the admin need persistent admin permissions? Why does the ERP package need to be installed locally with admin permissions on local computers?
    – schroeder
    Commented Oct 5, 2022 at 14:33
  • You want the person to have local admin rights on some computers but not all? Or do you not want him to have local admin rights at all?
    – schroeder
    Commented Oct 5, 2022 at 14:34
  • There are 15 managers computers that they don't want hi to have any access to. Our last software update required him to manually install an update on computers.
    – RonMidwest
    Commented Oct 5, 2022 at 15:18
  • So, I'm not seeing a problem here... You install the update with someone who has the right permissions, or you temporarily grant local admin permissions to the admin, then revoke...
    – schroeder
    Commented Oct 5, 2022 at 15:20

2 Answers 2


The canonical way to implement that kind of scenario according to Microsoft's best practice recommendations is:

  1. create a global security group "ERP software admins" in your AD domain and make the ERP software its member
  2. create a domain local security group "local admin permission on ERP workstations" in your AD, and make it a member of the local Administrators group on every workstation where the ERP software admin should have local admin permissions
  3. make group "ERP software admins" a member of group "local admin permission on ERP workstations"

(Adapt the names of the groups to your naming convention, and possibly substitute a more fitting characterization for the workstations in question.)

Once the installation is done, you can revoke the permission by removing group "ERP software admins" from group "local admin permission on ERP workstations" but leave the two groups in place for future requests.


You may consider using an Endpoint Privilege Management solution that helps in removing the local admin rights altogether and provides access only when needed. Typically, EPM solutions create an inventory of all applications and processes that require admin rights to install and run. You can create policies whitelisting specific applications for specific users or groups. This will allow end users to run the approved applications seamlessly.

In addition, they can raise requests to run new applications or even get full admin access for a limited duration. So you can grant your temporary admin access to your ERP software, to specific users, admins, and user groups as required.

You may take a look at Securden Endpoint Privilege Manager which does this and helps mitigate security risks related to local admin rights, https://www.securden.com/windows-privilege-manager/index.html (Disclosure: I work for Securden).

  • Thanks for the disclosure. Can you also suggest a competitor? That will help this be less of an ad for your product.
    – schroeder
    Commented Nov 3, 2022 at 11:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .