Permissions to run Windows Updates on DCs

Archived from groups: microsoft.public.win2000.active_directory (More info?)

There might be, but quite frankly, the only people who should be logging into
DCs interactively and modifying files on the machine are server operators. If
you have people you allow this access, they don't have to do much to get domain
admin access anyway so you might as well just give it to them.

joe

--
Joe Richards Microsoft MVP Windows Server Directory Services
www.joeware.net


Carl wrote:
> We want to allow our Server Operators to run Windows Updates on the Domain
> Controllers in our domains. Currently, they are told that they don't have
> adequate permissions when they try to install any of the updates. Our
> Domain Admins do not have problems when trying to install the updates.
>
> Is there something in the Domain Controller Policy that will allow them to
> do this? Is there something else that we are missing?
>
> Thanks,
> Carl
>
>

Archived from groups: microsoft.public.win2000.active_directory (More info?)

Ah sorry, typo. What I meant to say is the only people who should be logging
onto DCs are ADMINISTRATORS. Any server op has the power to easily escalate
their permissions to the level of admin in about a minute.

joe

--
Joe Richards Microsoft MVP Windows Server Directory Services
www.joeware.net


Carl wrote:
> Joe,
>
> I don't understand your response. My people are ALREADY members of the
> Server Operators BUILTIN group yet they are unable to run Windows Updates on
> the DCs. Its not server access that we are worried about - it is AD
> permissions. That is why they aren't Domain Admins.
>
> Carl
>
> "Joe Richards [MVP]" <humorexpress@hotmail.com> wrote in message
> newsR2kplZIFHA.3612@TK2MSFTNGP09.phx.gbl...
>
>>There might be, but quite frankly, the only people who should be logging
>
> into
>
>>DCs interactively and modifying files on the machine are server operators.
>
> If
>
>>you have people you allow this access, they don't have to do much to get
>
> domain
>
>>admin access anyway so you might as well just give it to them.
>>
>> joe
>>
>>--
>>Joe Richards Microsoft MVP Windows Server Directory Services
>>www.joeware.net
>>
>>
>>Carl wrote:
>>
>>>We want to allow our Server Operators to run Windows Updates on the
>
> Domain
>
>>>Controllers in our domains. Currently, they are told that they don't
>
> have
>
>>>adequate permissions when they try to install any of the updates. Our
>>>Domain Admins do not have problems when trying to install the updates.
>>>
>>>Is there something in the Domain Controller Policy that will allow them
>
> to
>
>>>do this? Is there something else that we are missing?
>>>
>>>Thanks,
>>>Carl
>>>
>>>
>
>
>