NT 4 Domain Users

Does anyone know how to allow Domain Users logging on to an NT 4 domain to perform administrative functions. When I say administrative functions I mean things such as windows updates and disk defrags. Now I have tried elevating them to power users on their machines but they still cannot not do automatic updates or disk defrag on Windows XP Pro and Windows 2000 Pro. If they could do their own updates and defrag their own machine then that would save me the time of having to go and update every box myself as the Domain Admin. Any thoughts or links would be greatly appreciated.

You could always add them to the Local Administrators group....they become Admins of their own machines.

This does not give them Domain or Server Admin rights.....

Installing patches is an administrative function by definition, so either make them a domain admin or you have to create a local admin account (or give them local admin rights on each machine). As the number of workstations increase, it becomes more or less a pain in the ass to use local accounts so depending on your environment, you'll have to decide where the cut off is. Personally, I'd go with a domain admin account but that's just me. ;)

--TH13

Never actually tried it so M$ might be speaking with a forked tongue but:

Quote:

---

If you choose to install updates when notified, you must be logged on as an administrator or a member of the Administrators group. However, installation will take place during the scheduled install time regardless of who is logged on to the computer at that time.

---

Taken from the Automatic Updates Help in Win2k.

Try that, it might work.

I cannot help for the degraf feature but I can help for the update... You can set up a SUS Server (All you need fot this is a Windows 2000 Server with IIS) or you can use Microsoft Server. When you decided what server you want, you change your domain policy to force all Windows 2000 and XP machine to use Automatic Update Feature to automaticly install the update at a specif time (Usually a 5:00am the morning but you'll need a WakeOnLand utilites for that). Good Luck.. I may post a Tutorial on that soon.

Tiger and SDK are on the money for automated installs of patches. However, if you want "on the spot" service, we have had best results with admin rights. :D

I do not want to give them local Admin rights. These users like to play with system things too much and some do things like install IIS on Win XP. So as you can see local Admin or domain admin is not an option. I need to figure out how the microsoft update site is getting the information about the user logged on ( Admin or not ), and stop that token from being passed or somehow allow it to remember the run as feature ( username and password ) for the next time they are logged on. I have made all the domain users power users, but as we all know unless they are a member of the administrator group they cannot update or do disk defrag. Also, we are stuck with the NT 4 server for at least another 4 months, since microsoft has extended support. If I had a new server like 2003 I could fix all of the problems with OUs and group policies. I have about 60+ users and alot of them would like to think of themselves as the network administrator, which they are not. Oh well I guess I'll just have to periodically update all the machines myself.....what a pain.

NotNew: See my post above..... For Autoupdates this will work for you.... Just run round once setting autoupdates to D/L automatically - put the users back as regular users and tell them to only switch off the monitor at night so you can schedule the install for off hours.

The defrag issue is a different question and since it runs from the msc I can't find a way to automate it at the moment.

[Edit]

and the answer to the defrag question is here. You can't..... They don't really own the defrag software...... :rolleyes:

[/Edit]

You can check my Tutorial on How to keep Windows 2000, XP, 2003 and Office update painless at http://www.antionline.com/showthread...hreadid=251235

I have used this executable to do what you are trying to do with backup and other services, I did not look to see if update was one of the services. But it might help you for defrag and others that are user group sensitive.

http://support.microsoft.com/default...b;en-us;311866