Permission to act

The ability to acknowledge and act on update messages on a client, when set
for administrators only, is a good thing. Does anyone know if/how this
ability could be further restricted to, for example, members of an AD group?
I'm in a situation where it's great to have only administrators log onto a
box and manually apply the patches made available by WSUS, but also where
there are just too many administrators.

GrahamH wrote:
> The ability to acknowledge and act on update messages on a client,
> when set for administrators only, is a good thing. Does anyone know
> if/how this ability could be further restricted to, for example,
> members of an AD group? I'm in a situation where it's great to have
> only administrators log onto a box and manually apply the patches
> made available by WSUS, but also where there are just too many
> administrators.

Wouldn't matter if there was..
Administrator equals the ability (whether or not the skills are there or
not) to override anything anyone else sets.

--
Shenan Stanley
MS-MVP
--
How To Ask Questions The Smart Way
http://www.catb.org/~esr/faqs/smart-questions.html

True, true. I guess all I'm really after is to restrict the alert that an
administrator gets when they log on. It's the acting on updates outwith
Change Control that concerns me most here, as the administrators I refer to
are all suitably experienced but well-intentioned accidents (in Change
control terms) do happen.

"Shenan Stanley" wrote:

> GrahamH wrote:
> > The ability to acknowledge and act on update messages on a client,
> > when set for administrators only, is a good thing. Does anyone know
> > if/how this ability could be further restricted to, for example,
> > members of an AD group? I'm in a situation where it's great to have
> > only administrators log onto a box and manually apply the patches
> > made available by WSUS, but also where there are just too many
> > administrators.
>
> Wouldn't matter if there was..
> Administrator equals the ability (whether or not the skills are there or
> not) to override anything anyone else sets.
>
> --
> Shenan Stanley
> MS-MVP
> --
> How To Ask Questions The Smart Way
> http://www.catb.org/~esr/faqs/smart-questions.html
>
>
>

One can be logged on as the "Administrator" or logged on
as a member of the "Administrators Group" in order to
install Windows Updates.

You can configure Automatic Updates by using Group Policy
in an Active Directory environment, or by using registry settings
in a non-Active Directory environment. For more information
about how to configure Automatic Updates by using these methods,
click the following article number to view the article in the
Microsoft Knowledge Base:

How to configure automatic updates by using Group Policy or registry settings
http://support.microsoft.com/kb/328010/

"Administrator" is an account. If a permission or privilege
is granter to the Administrator, it can be done only by someone
logged in with the Administrator account. That is, the account
whose name defaults to "Administrator".

"Administrators", on the other hand, is a "group". If you are
a member of the "Administrators Group", you have been granted
administrator privileges on that particular computer. It is
membership in the "Administrators Group" that people refer to
when they say things like "I'm an administrator on this computer".

--
Carey Frisch
Microsoft MVP
Windows - Shell/User
Microsoft Community Newsgroups
news://msnews.microsoft.com/

---------------------------------------------------------------------------Â*----------------

"GrahamH" wrote:

| The ability to acknowledge and act on update messages on a client, when set
| for administrators only, is a good thing. Does anyone know if/how this
| ability could be further restricted to, for example, members of an AD group?
| I'm in a situation where it's great to have only administrators log onto a
| box and manually apply the patches made available by WSUS, but also where
| there are just too many administrators.