Giving ServerOperators to add / remove programs right

[Guest]

Archived from groups: microsoft.public.win2000.security (More info?)

Hi all,
Is there a way to give ServerOperators group to add / remove programs right?
Soon we will deploy about 500 Domain Controllers (win2k3) and our tests show
that they are not able to add/remove programs , besides they cannot use
device manager neither.
I do not want to add them to administrators group which have plenty of
rights in the AD.
Any solution?
Thanks in advance for any help.

Selcuk Demiray

 

[Guest]

Archived from groups: microsoft.public.win2000.security (More info?)

Server operators can not install software on domain controllers. For this a domain
admin must be used. It is possible to use Group Policy to deploy .msi packages to
domain computers or users. For what would be considered mandatory installs it would
be best to configure a .msi package to be assigned via computer policy portion of
Group Policy. You might also be able to install the needed software before you
dcpromo a server which would need local administrator rights. --- Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;314934

"Selcuk Demiray" <sdemiray at yahoo com> wrote in message
news:uFYYxDKoEHA.708@TK2MSFTNGP09.phx.gbl...
> Hi all,
> Is there a way to give ServerOperators group to add / remove programs right?
> Soon we will deploy about 500 Domain Controllers (win2k3) and our tests show
> that they are not able to add/remove programs , besides they cannot use
> device manager neither.
> I do not want to add them to administrators group which have plenty of
> rights in the AD.
> Any solution?
> Thanks in advance for any help.
>
> Selcuk Demiray
>
>