I need to create a group on our Windows Server 2008 R2 boxes, that allows members to perform the following administrative tasks:
- Unrestricted access to he file system (although all activity logged, and access to the logs read only, which leads to...)
- Read only access to all logs
- Stop/Start/Restart services
- Kill processes from any user
- Reboot the server
However, I don't want them to have the following rights:
- Install/uninstall software
- Install/uninstall drivers
- Create/modify users
- Create modify groups
My initial thoughts were to create a group, add that group to the Administrators group, and use various ACLs to set the deny permissions. However, when you open the properties of a local security group, there is no Security tab. I also could not think of any way to restrict software/driver etc. installation other than with AppLocker.
Does anyone have any experience setting up these kind of semi-restricted interim admin groups? I want to avoid having to give 3rd party software vendors or application specialists full administrator access to our servers, yet need them to be able to perform basic troubleshooting tasks on their applications.