3

We have a windows terminal server used by support staff. They do not have local admin rights on the terminal server. However they do have local admin rights on various Server 2003 file servers that they connect to from the terminal server and administer. One of their common tasks is creating shares on the remote servers.

Recently we migrated from 2003 to 2008 R2 on the terminal server. Since then they have been unable to create shares remotely on the 2003 file servers using computer management. They can launch computer management and connect to the remote server, then load the list of shares, but they cannot create a share. Error says "requires elevation".

It seems as though because you would need to elevate to create a share on the local machine, the mmc is requiring you to elevate but not providing a way to do so for the remote machine.

Does anyone know a way to use MMC to manage a remote machine with full elevated admin rights on the REMOTE machine but without admin rights on the local machine which you are running the MMC console?

Improve this question

3 Answers 3

Reset to default
0

I agree with KCotreau but I can't comment yet with being a noob so had to write it here instead. The shared folders MMC is the old one that was in 2003 an should allow you to lanuch it after you have created it first. when creating it you will be prompted for admin rights but go through the settings and turn off the need for admin rights and allow users to select the servers. this should work. If it doesnt let us know and I know of an alternative but it requires a bit more work.

Improve this answer
4
  • Thanks, I gave it a try but still the same problem. I couldn't find an option to turn off admin rights, I put the console mode into User mode - limited access, didn't seem to make any difference unfortunately. Starting to think I'm going to have to go down the script route.
    – Grez
    May 31, 2011 at 11:13
  • Take a look at this social.technet.microsoft.com/Forums/en-US/winserverManagement/… I don't think you can do it...So you may need to disable UAC as it mentions in that post.
    – Mucker
    May 31, 2011 at 12:47
  • Thanks this article gave me the idea to try adding them into the Power Users group which seems to work and is a reasonable compromise rather than giving them full admin rights.
    – Grez
    Jun 1, 2011 at 11:58
  • great glad to hear that helped.
    – Mucker
    Jun 1, 2011 at 21:03
0

How about psexec and "net share", or the equivalent in PowerShell using WMI-R or whatever?

Improve this answer
1
  • Yeah using a command line tool or script was going to be my "plan b" but it will involve retraining the staff, updating their work instructions etc. I was hoping there would be a way to do it while still using the MMC GUI. Thanks anyway.
    – Grez
    May 27, 2011 at 14:29
0

I just tried this so I think this will work for you:

  1. Start>Run and type in mmc.
  2. File>Add/Remove Snap-in
  3. Add Shared Folders and select "Another computer" for each computer you want to manage. I am not sure if it is needed, but I would also check the box "Allow the selected computer..."
  4. Save the MMC for further use.

It should let you do what you want then.

Improve this answer
1
  • Hi I tried this, saved the mmc and copied across to one of the users but although they could launch it OK it still would not let them add a share, same error about requiring elevation.
    – Grez
    May 31, 2011 at 11:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .