Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a SBS 2003 running AD, DNS, Exchange etc.... this is a manufacturing environment that runs 24 x 7 seven days a week. Very seldom but we do experience a Server lockup and need to reboot the server. Currently only one person is server admin and knows the administrator login name and password. Of course this causes headaches if a lockup occurs in the middle of the night when there is no server admin in the building. Owner does not want anybody else to have Domain Admin login name and password for security reasons.

So here is my question ?

Is there a way to setup a user account that can logon locally at the server that will have enough rights assigned to it so everything will still function properly like backups etc... but be limited so they do not have full domain administrator rights. This way we can assign a night server admin that can reboot the server and logon with this account without having to worry about that account having too many rights that they can get carried away and do damage if they ever so desired. I have done some research on enabling local login on the server but i am not sure how to setup the user account to have the correct set of rights and groups it needs to belong to etc... Should i create a new user group and assign it certain levels / rights ?

Thanks for any help that can be offered

share|improve this question

1 Answer 1

On the server's Local Security Policy (secpol.msc) go to the following area:

  1. Security Settings
  2. Local Policies
  3. User Rights Assignment
  4. Force shutdown from a remote system
  5. Add the user who you want to be able to shutdown the server.

Now if a user needs to shut the system down from their PC, they can use the following command:

shutdown /r /m \\servername /f 

If you really want someone to be able to log in locally, and be able to restart the system, follow steps 1-3 in the first section, and add the user/group to "Shut Down the system"

share|improve this answer
1  
+1. I think the remote option is good if the server is still responsive, but the local login option may be a necessary evil. –  user3914 Apr 27 '12 at 3:37

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.