Permissions to run Windows Updates on DCs

  • Thread starter Thread starter Carl
  • Start date Start date
C

Carl

We want to allow our Server Operators to run Windows Updates on the Domain
Controllers in our domains. Currently, they are told that they don't have
adequate permissions when they try to install any of the updates. Our
Domain Admins do not have problems when trying to install the updates.

Is there something in the Domain Controller Policy that will allow them to
do this? Is there something else that we are missing?

Thanks,
Carl
 
There might be, but quite frankly, the only people who should be logging into
DCs interactively and modifying files on the machine are server operators. If
you have people you allow this access, they don't have to do much to get domain
admin access anyway so you might as well just give it to them.

joe
 
Joe,

I don't understand your response. My people are ALREADY members of the
Server Operators BUILTIN group yet they are unable to run Windows Updates on
the DCs. Its not server access that we are worried about - it is AD
permissions. That is why they aren't Domain Admins.

Carl
 
Ah sorry, typo. What I meant to say is the only people who should be logging
onto DCs are ADMINISTRATORS. Any server op has the power to easily escalate
their permissions to the level of admin in about a minute.

joe
 
Back
Top