Windows Server 2008 Permissions for Application Support

Question

I need to create a group on our Windows Server 2008 R2 boxes, that allows members to perform the following administrative tasks:

• Unrestricted access to he file system (although all activity logged, and access to the logs read only, which leads to...)
• Read only access to all logs
• Stop/Start/Restart services
• Kill processes from any user
• Reboot the server

However, I don't want them to have the following rights:

• Install/uninstall software
• Install/uninstall drivers
• Create/modify users
• Create modify groups

My initial thoughts were to create a group, add that group to the Administrators group, and use various ACLs to set the deny permissions. However, when you open the properties of a local security group, there is no Security tab. I also could not think of any way to restrict software/driver etc. installation other than with AppLocker.

Does anyone have any experience setting up these kind of semi-restricted interim admin groups? I want to avoid having to give 3rd party software vendors or application specialists full administrator access to our servers, yet need them to be able to perform basic troubleshooting tasks on their applications.

Answer 1

You have contradictions in your requirements.

You can't have "Unrestricted access to the filesystem" and accomplish any of the other requirements. Arbitrary filesystem access (assuming you mean read/write when you say "unrestricted") means that system binaries can be replaced, configuration files can be overwritten, etc. You can always "leapfrog" from arbitrary read/write access to the filesystem to "Administrator" rights. Remove that requirement and it's not such a big deal (but not dead easy, either).

You can change the security descriptors on your services and event logs to achieve those goals.

Ending any other user's process is going to be difficult. There's no "default security descriptor" for processes that you can just change to include a permission to allow these demi-Administrators to kill processes wantonly.

Controlling rebooting the machine is a piece of cake. That's just a privilege.

I think you've got some homework to do but what you want is, with some caveats, within the realm of possibility.