Re: User's rights on domain controller to perform some administrative

From: Roger Abell (
Date: 05/11/05

Date: Tue, 10 May 2005 19:33:48 -0700

Well, it is really all going to come down to just exactly why
the user is denied. For example, if it is just lack of write access
to where this application is stored, or to the registry keys of this
application, then tweaking those would be a possible resolution.

To help you out we need to know just what is in the way.

Roger Abell
Microsoft MVP (Windows  Security)
MCSE (W2k3,W2k,Nt4)  MCDBA
"cosimo" <> wrote in message
> I've this problem:
> On a Windows Server 2003 Domain Controller (in a small network) is
> (beyond Active Direcory) a client/server software that the users must use
> their work from their clients.
> The problem is that this software must be regularly updated on
> base and that is possible only by locally logon to the DC.
> I'd like to assign this task to a particular user but I don't want to join
> him/her to the Domain bult-in administrators group.
> I've tried to add this user to the Server Operators Group, but he/she
> perform the task because is denied.
> There is a solution (simple, please...) to resolve the question?
> Thanks in advance.
> Cosimo Mercuro