Re: Possible to grant additional rights to a built-in group

From: Christian (
Date: 10/01/04

  • Next message: jerrycons: "Please help - IIS App won't write to event log on Windows 2003"
    Date: Fri, 1 Oct 2004 11:04:35 +0200

    Yep, I got the same respons from an MS Partner posting. DHCP does not
    support delegation.


    Hi Christian,

    Thank you for your posting.

    According to your post, I understand that you want to grant additional
    permission to DHCP users group to create and delete Reservations in DHCP
    while not using DHCP administrators group. If I am off-base on that,
    please let me know.

    I am afraid that it cannot be done. To grant other uses with the
    permission to create reservation, you must put it in to DHCP admin
    group. DHCP does not support delegation.

    For more info, please refer to:
    283301 You Cannot Delegate DHCP Administration

    Have a nice day!>


    "Steven L Umbach" <> wrote in message
    > From what I can tell, users will need to be in the DHCP admins group to
    > manage DHCP. That is the reason for that group and it does not give a user
    > local or domain administrative permissions. Many rights are hard coded
    > into the operating system and can not be granted to a user. For instance
    > in Windows 2000 only administrators can change tcp/ip settings, there is
    > no work around. AD delegation would not help for DHCP administration. --
    > Steve
    > "Christian" <> wrote in message
    > news:umdBbh1pEHA.2104@TK2MSFTNGP10.phx.gbl...
    >> Thanks for you reply.
    >> I am aware how to delegate authority and how to use the various security
    >> policies ... in my own opinion, at least ;-)
    >> Delegation and security plicies does not help me here, I am affraid. I
    >> need to assign additional access rights to a built-in group (DHCP USers)
    >> already granted to another built-in group (DHCP Administrators). My
    >> problem is that I don't have a clue what those rights are for the DHCP
    >> service and where they are assigned. I am pretty sure it is not
    >> delegation issue, though.
    >> I have assigned my test users Full Control everywhere I can think of
    >> (OU/NetServices/file system etc.), but unless I assign the to the
    >> Administrators or DHCP Administrators group, they still get "Access is
    >> Denied" for all the actions in the DHCP console.
    >> Cheers,
    >> Christian
    >> "Steven L Umbach" <> wrote in message
    >> news:eNX5jOxpEHA.2724@TK2MSFTNGP14.phx.gbl...
    >>> You can manage user rights in the appropriate security policy such as
    >>> domain/local/OU. For instance open Local Security Policy via secpol.msc
    >>> and then go to security settings/local policies/user rights to view the
    >>> user rights that can be configured. For an Active Directory domain you
    >>> can "delegate" authority to users/groups for many administrative tasks.
    >>> The link below explains in more detail. --- Steve
    >>> "Christian" <> wrote in message
    >>> news:%23GoA9IspEHA.1668@TK2MSFTNGP14.phx.gbl...
    >>>> Is it possible to grant additional user rights to a built-in group?
    >>>> How can I see what the currect access rights are and to what objects
    >>>> they apply?
    >>>> I am trying to enhance the capabilities of the DHCP Users built-in
    >>>> group to allow my HelpDesk perform minor adminitrative tasks without
    >>>> adding them to the DHCP Administrators built-in group.
    >>>> Any pointers are greatly appreciated!
    >>>> Cheers,
    >>>> Christian

  • Next message: jerrycons: "Please help - IIS App won't write to event log on Windows 2003"