Suggestions for administrator deployment through Config Manager

[Tevura]

Hi all,

 

First off, I've been a lurker who's benefited a great deal by the knowledge thrown around on these forums for a little bit so thank you! Long story short, I'm a junior admin in training who's been given the responsibility of managing SCCM in my workplace. My senior administrator has tasked me with creating a solution of granting and managing local admin rights to users who request such elevated permissions and are approved for it. These are his requirements below:

 

1. Requests for Administrator access are subject to an approval process.

2. Users should be able to install the permissions on their own once approved.

3. Users can only install the permission on their own computer.

4. If the permission is revoked, the permission should be removed from any computer where it is installed.


I'm really new to both SCCM so my knowledge on functioning solutions is limited, hence why I'm reaching out for possible solutions. I've Googled extensively for any ideas but nothing seems to remotely fit this criteria. The only thing I've been able to think of is creating a script and deploying it as an Application requiring approval. I'd also imagine device affinity and a GPO should be in place to answer 3 and 4. Any additional thoughts or suggestions would be incredibly appreciated!

[Peter van der Woude]

The first thing that I would say that ConfigMgr will not be your real (complete) solution in this case. The main reason is that, yes it does some sort of approval, but you can't revoke that. You would really need some service management tooling for that.