Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

We're trying to get Windows Media Services running, and so far it works well. However, we'd also like the ability to allow people to administer WMS without being in the Administrators group for the server in question. When we add a group to the local Administrators group things work as they should. Unfortunately, how to make this happen is not terribly well described in the documentation.

The closest I've come is a Microsoft MSDN article:

http://msdn.microsoft.com/en-us/library/dd892105(VS.85).aspx

Which doesn't seem to do what I need it to do, membership in 'Administrators' is still required. Is this the only way to accomplish this (meaning, I missed a step) or is there another way to do it?

This is running on Server 2008R2.

share|improve this question

1 Answer 1

After some research I found this: Windows Media Services - Limiting user rights

By default, Windows Media Services can only be accessed by users in the Administrators group. To limit user rights effectively while still enabling users to administer Windows Media Services, you can remove users from the Administrators group and then add them to Windows Media Services only. To add users directly to Windows Media Services, you must use Component Services to configure access permissions for the Windows Media Services Component Object Model (COM) object.

You can move the majority of your Windows Media server users to a group, such as the USERS user group, that grants them adequate permissions for performing non-administrative tasks on the server. If you grant users access to the Windows Media Services COM object directly, they can perform most functions in the Windows Media Services snap-in and Windows Media Services Administrator for the Web, such as adding publishing points and monitoring client activity. Limiting the number of users with full rights greatly reduces the potential for security lapses.

To provide a user or user group administrative rights to Windows Media Services

  1. On your server, start the DCOM config utility.
  2. Locate Windows Media Services in the list, and open its properties.
  3. On the Security tab, edit the access permissions. You can create here also a custom security group where you put in the user who need administrative access to Windows Media Services
  4. Add the users or groups that you want to be able to administer Windows Media Services, and then close the dialog boxes.

The new settings will take effect when you restart Windows Media Services.

To make user administration easier, you can create a new user group by using Computer Management and add the group to the Windows Media Services access permissions list. Then you can use Computer Management to add or remove users from the group, rather than doing so with DCOM config. By creating a new group, you can add or remove users without having to restart Windows Media Services. Groups also enable you to manage user privileges for the whole server at the same time.

Source: Limiting user rights

I found no other way to accomplish this.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.