Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 468
  • Last Modified:

Can only use SMS Admin Console if a Domain Administrator?

I need to add a user to be able to use Remote Tools with SMS. Whenever he launches the SMS Admin Console it immediately says Connection Failed: \\mysmsserver...  It works on the same computer when I run it as myself, so its not a connectivity issue.  We have tested and it looks like once we take someone out of the Domain Administrators group in Active Directory they get the same Connection Failed error.  Once they are put back in the Domain Admins group they can connect again.

Is there a lesser security group we can add users to so they can use SMS but not be a Domain Admin?
0
eServ
Asked:
eServ
  • 5
  • 2
1 Solution
 
U_ManssonCommented:
You can configure a new or existing group/user in the console under Security Rights with the access the group/user should have in SMS
0
 
eServAuthor Commented:
I have tried this extensively.  I have cloned our highest security group's rights to this user and he still cannot connect.
0
 
Adam LeinssCommented:
Add him to SMS Admins.  This is a local group that gets created on the SMS server.

Also, you'll need to make sure you add members to the remote tools group in SMS and give him rights to see the collections that they want to control.
0
Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
eServAuthor Commented:
Ok I followed your direction still no luck.  But what I did was create a test user that does not have domain admin rights but can access the server and open the SMS Administrator Console.  But when I install the SMS Administrator Console on a remote machine and use the test account it gets a connection failed.  If I give test user domain admin rights all works fine.  Thoughts on why it works ok on the server but not on a remote computer?
0
 
eServAuthor Commented:
Error message from client machine: Error(ConnectServer): Possible UI connection error code is -2147024891 [0x80070005]
0
 
Adam LeinssCommented:
0x80070005 means Access Denied.

Unfortunately, my SCCM server is at work, so I can't look how I have the techs setup, but there is a MS knowledge base article on this:

http://support.microsoft.com/kb/317872

Since it works on the local server with someone not in DA, I would start with the section "How to troubleshoot server connectivity" and work your way down.  I remember something vaguely about DCOM permissions when remote users couldn't run reports from the IIS server.

0
 
eServAuthor Commented:
I will give it a shot - Thanks
0
 
eServAuthor Commented:
Ok went through that article and I get to: Troubleshooting SMS namespace connectivity.  When I walk through this I get the following error


error.jpg
0

Featured Post

Problems using Powershell and Active Directory?

Managing Active Directory does not always have to be complicated.  If you are spending more time trying instead of doing, then it's time to look at something else. For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why

  • 5
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now