We have a server here that is used by our web developers, they have local admin access to the machine but are unable to shut the server down due to domain security policy. Because this option is enforced by group policy i can not change it even when logged in as a domain admin. Obviously i do not want to give the devlopers domain admin access, and do not want to have to create a new ou for one machine. Does anyone have any ideas on how i could do this.
Tek-Tips is the largest IT community on the Internet today!
Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!
-
Congratulations strongm on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!
Enable shutdown of a machine with local admin account
- Thread starter fox007ss
- Start date
- Thread starter
- #3
They can not shut down because the domain security policy only allows domain admins to shut down a server, if anyone not in the domain admin group tries the option is either grayed out such as with the restart now or later prompts after installing an option, or simply does not show up if they go to the start menu. They get an access denied message if they type shutdown within a cmd prompt.
Only way I can think of to do this is to compile a script using AutoIT.
In AutoIT you can specify a user to run a command as. You can then compile the script so that users can't see what the password is.
The only problem with that is that they will then have a universal shutdown command for your domain!
Creating a new OU is probably your safest bet. It's what I would do.
In AutoIT you can specify a user to run a command as. You can then compile the script so that users can't see what the password is.
The only problem with that is that they will then have a universal shutdown command for your domain!
Creating a new OU is probably your safest bet. It's what I would do.
- Thread starter
- #5
You don't mention where that GPO is applied. Why not create another GPO that grants them the right to shutdown? Toss their servers in an OU, apply your new GPO to the OU, and you're done.
Pat Richard, MCSE MCSA:Messaging CNA
Microsoft Exchange MVP
Want to know how email works? Read for yourself -
Pat Richard, MCSE MCSA:Messaging CNA
Microsoft Exchange MVP
Want to know how email works? Read for yourself -
- Thread starter
- #7
fox007ss said:
Well, there you have it. Your boss seems to have the answer.
I think if you read many of the deployment whitepapers and other online resources, you'd find that the solutions mentioned here are within Microsoft's best practices.
Pat Richard, MCSE MCSA:Messaging CNA
Microsoft Exchange MVP
Want to know how email works? Read for yourself -
- Status
Similar threads
- Locked
- Question
- Locked
- Question
