User/group Rights On Windows 2008

[sirjune]

Hi,

 

This may be an easy one but I'm having trouble setting this up and can't find a suitable guide in the the net.

I have a Windows 2003 server as Domain Controller. Inside I have a TerminalServers group and members are a window2003 terminal server and a new windows2008 terminal server. I need a policy that grants my remote desktop users to install software/applications on windows2008 server, but they should not be able to Shutdown or Reboot the server. I tried going to local policy-> user rights on win2008 but can't seem to find such procedure to achieve this. Of course, another group exists, domain administrators which must retain full rights on the server. In summary, a user has admin rights to install but should not be able to reboot the server.

 

thanks,

Sirjune

[ICTCity]

Hi,

 

This may be an easy one but I'm having trouble setting this up and can't find a suitable guide in the the net.

I have a Windows 2003 server as Domain Controller. Inside I have a TerminalServers group and members are a window2003 terminal server and a new windows2008 terminal server. I need a policy that grants my remote desktop users to install software/applications on windows2008 server, but they should not be able to Shutdown or Reboot the server. I tried going to local policy-> user rights on win2008 but can't seem to find such procedure to achieve this. Of course, another group exists, domain administrators which must retain full rights on the server. In summary, a user has admin rights to install but should not be able to reboot the server.

 

thanks,

Sirjune

 

To allow users to be able to install programs, you must understand the "Software Restriction Policy": http://technet.microsoft.com/en-us/library/bb457006.aspx I know it could be annoying, but assign the wrong permission to software installation, can be harmful for your system (not only for malwares).

 

To deny users to shutdown the server:

Local Policy > Users rights assignment > SHUT DOWN THE SYSTEM Select only the user / group you want to able to shutdown your server.

 

 

Remember that GPO must be refreshed to take effect: start > run > gpupdate /force

 

 

Or you can restart the server...