User rights of logon server locally, start/stop services, kill pro

Pakeon,
the most common solution to this set of requirements involves use of Group
Policies. For stand-alone systems, simply run gpedit.msc - for domain-based
systems, use Group Policy Management Console. Logon/shutdown related tasks
are controlled by settings under Computer Configuration\Windows
Settings\Security Settings\Local Policies\User Rights Assignment and
Computer Configuration\Windows Settings\Security Settings\System Services.
Ability to kill an arbitrary process would depend on its security context -
but as long as the process was not launched by the current user, it would
typically require local Administrator privileges...

hth
Marcin

"Pakeon" wrote in message
news:

Hi all,

I wonder whethere there are some ways to delegate specific rights to some
ones who are able to logon server locally, start and stop certain
services,
kill certain processes, reboot/shutdown servers?

Thanks in advance.

Pakeon

Marcin,

Thanks for your information! What about the network configuraiton change? Is
there a way to grant particular usres who are only able to update server
network configuraiton such as IP address, DNS suffix...?

Any idea?

Thanks in advance

Pakeon


"Marcin" wrote:

Pakeon,
the most common solution to this set of requirements involves use of Group
Policies. For stand-alone systems, simply run gpedit.msc - for domain-based
systems, use Group Policy Management Console. Logon/shutdown related tasks
are controlled by settings under Computer Configuration\Windows
Settings\Security Settings\Local Policies\User Rights Assignment and
Computer Configuration\Windows Settings\Security Settings\System Services.
Ability to kill an arbitrary process would depend on its security context -
but as long as the process was not launched by the current user, it would
typically require local Administrator privileges...

hth
Marcin

"Pakeon" wrote in message
news:
> Hi all,
>
> I wonder whethere there are some ways to delegate specific rights to some
> ones who are able to logon server locally, start and stop certain
> services,
> kill certain processes, reboot/shutdown servers?
>
> Thanks in advance.
>
> Pakeon

On Wed, 14 Jan 2009 21:06:00 -0800, Pakeon wrote:

Thanks for your information! What about the network configuraiton change? Is
there a way to grant particular usres who are only able to update server
network configuraiton such as IP address, DNS suffix...?

That depends on the operating system. In Windows 2000, which is what this
news group is for, I believe that you need to use membership in Power Users
or Server Operators (sorry but it has been years since I worked with
Windows 2000). For Server 2008 there's a local group called Network
Configuration Operators that will do what you want.

Paul Adare
MVP - Identity Lifecycle Manager
http://www.identit.ca

I'm running Windows server 2003. I don't want to add them to Server Operators
or Power Users. I want to grant explicit rights to the group that is
responsible for particular tasks, such as Network configuration.

Thanks

Pakeon

"Paul Adare" wrote:

On Wed, 14 Jan 2009 21:06:00 -0800, Pakeon wrote:

> Thanks for your information! What about the network configuraiton change? Is
> there a way to grant particular usres who are only able to update server
> network configuraiton such as IP address, DNS suffix...?

That depends on the operating system. In Windows 2000, which is what this
news group is for, I believe that you need to use membership in Power Users
or Server Operators (sorry but it has been years since I worked with
Windows 2000). For Server 2008 there's a local group called Network
Configuration Operators that will do what you want.

Paul Adare
MVP - Identity Lifecycle Manager
http://www.identit.ca

Network Operators group is available in Windows Server 2003 as well...

hth
Marcin

"Pakeon" wrote in message
news:

I'm running Windows server 2003. I don't want to add them to Server
Operators
or Power Users. I want to grant explicit rights to the group that is
responsible for particular tasks, such as Network configuration.

Thanks

Pakeon

"Paul Adare" wrote:

On Wed, 14 Jan 2009 21:06:00 -0800, Pakeon wrote:

> Thanks for your information! What about the network configuraiton
> change? Is
> there a way to grant particular usres who are only able to update
> server
> network configuraiton such as IP address, DNS suffix...?

That depends on the operating system. In Windows 2000, which is what this
news group is for, I believe that you need to use membership in Power
Users
or Server Operators (sorry but it has been years since I worked with
Windows 2000). For Server 2008 there's a local group called Network
Configuration Operators that will do what you want.

Paul Adare
MVP - Identity Lifecycle Manager
http://www.identit.ca