Network admin people; How do you allow restricted users to update programs

[Kumagoro]

Can someone please point me in the right direction here. I am creating an image which will be deployed on say about 50 PCs and have been asked to find out how we can make it so restircted users can install the updates for programs such as Java, firefox, Imgburn, CCleaner etc.

It seems before they have been allowing read/write access to certain folders like firefox to achieve this. Other than the security implications it also seems time consuming, what other ways can it be done.

The systems will all be Win7 pro 32bit.

Can the task scheduler be used to do this with no user interaction (or some if need be) and possibly silently.

As I am supposed to be an Electronics engineer I dont know the terminology well or where to start looking. Ideally they dont want to be spending any money.

[Jay]

I don't think it can't really be done without changing permissions on the local PC

You could use GPO to distribute new programs and updates but that is also time consuming.

[Kumagoro]

Thanks for the reply Jay,

So far we have just gone with just giving them permission for the folders of the required programs and i suppose that would be good enough.

The only other thing i could find was using WSUS and some add on that a company made which allows you to push out updates for third party software but then they charge for it.
http://eminentware.com/index.html

Just now I have also found this http://www.localupdatepublisher.com/ I wonder if setting up WSUS + this would do the job. Hopefully it will as its free

I will have a look up about GPO as well cheers.

[gss03]

I am surprised that Microsoft haven't come down like a ton of bricks for localupdatepublisher.
WSUS is designed for deploying Microsoft updates to machines, nothing more.

MS want you to purchase one of their premium System Centre products (plus CALs!) to deploy other software to your machines on the network

A real bug bear for me is the adobe/ java updaters which by default go and check for updates (which doesn't need an elevated privelege to do so) and annoy my users when something needs installed - But all of which don't have admin rights to install this. Adobe release a reader update at least quarterly, and even sooner if there is a security threat they need to plug.

If your machines are in a domain environment I would control all your machines with group polices. Most apps come in MSI format, or there are tools to create the MSIs for you to then deploy - so, when adobe, Oracle or any other vendor releases an update you just update your policy with the new MSI and it'll deploy to your machines as they check in to your domain controller. A lot easier than giving your users elevated privileges to do this job, or even walking round a room doing it manually!

[Splash]

Not sure of the size of your business, but Shavlik have a good reputation for patch and software management. I haven't used them myself, but I know a few people who do and seemingly things are very easy to manage. They were recently acquired by VMWare, so I suspect that we'll be hearing more about them in the not too distant future.

[Kumagoro]

Splash, I had a look at that shavlik and it does seem nice and easy but although it seems to say free it looks like you do actually have to pay for it and its only a trial.

I would have thought something like this being free is highly unlikely so what other ways could it be done?

[Smudger]

I would 2nd the GPO route, or something like Kaseya or LANDesk, but these are paid-for apps again...

[Kumagoro]

How would you use GPO to do this, I only have a basic understanding of these things and need pushing in the right direction.

Here are some other programs I have found incase anyone else is looking for something similar in the future (not entirely sure if they do what I thnk they do haha)

http://sevenupdate.com/
http://omaha.googlecode.com/svn/wiki/OmahaOverview.html
http://www.google.com/support/instal...46164#Examples
http://wyday.com/wyupdate/ (not free bust has the souce code available)
http://w3sus.com/