Windows SBS 2008 how do I grant access to the SBS Management console so that a designated group or user can manage accounts and groups, without giving them full administrative rights?

Posted on 2009-12-28
Last Modified: 2012-05-08
Windows SBS 2008 how do I grant access to the SBS Management console so that a designated group or user can manage accounts and groups, without giving them full administrative rights?
Question by:dburk1
    LVL 12

    Expert Comment

    I believe you'll need to add such users/groups to a couple of groups accessible via Active Directory Users & Computers (not through the SBS console interface).
    You may find AD U&C in your Administrative Tools menu, or within Server Manager, under Roles -> Active Directory Domain Services.

    Expand your domain, and you can add your users/groups to the Builtin -> Account Operators security group.
    You may also want to add them to Microsoft Exchange Security Groups -> Exchange Recipient Administrators group.  But it might be that membership in the Account Operators group already gives them all the permissions they need.

    Author Comment

    I added the user in question to the Account Operators group using Active Directory Users and Computers, and not the "Console". The user still could not use the SBS Admin Console. There must be some way to grant access to it, since the local admins have the right. It would make sense that you would need an elevated priviledge to manage accounts, but you wouldn't want these people to have the right to change the full administrator level accounts and grant themselves additional rights. Is this even possible?
    LVL 12

    Accepted Solution

    Unfortunately, I don't think it's possible.

    It looks like Microsoft has locked down access to the SBS Console (console.exe) to administrators, probably via an embedded manifest.  And on SBS, since it's a domain controller, an administrator is a domain administrator.  Microsoft documentation (e.g. seems to indicate that they expect you to have the Network Administrator role if you want to use SBS Console.

    So while it should theoretically be possible to enable (parts of) SBS Console for users who are "merely" account operators, it seems that Microsoft has not made this an available option.  I think the general expectation is that a small organization using SBS shouldn't need to divide account management responsibilities on such a granular level.

    Account operators will still have permission to make corresponding changes via the normal Active Directory Users and Computers, but then of course you lose some of the automatic stuff like proper group membership, as well as the ease and convenience of the SBS Console interface.  If the tasks you expect them to perform are limited and predictable, you could instead create a custom MMC console, and focus on documenting appropriate account processes.  Here are a couple of links about creating custom MMC tools:

    Author Closing Comment

    Good response and sourced by Microsoft articles.

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    IT, Stop Being Called Into Every Meeting

    Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

    This is a based on my experience in IT role and also my role before that, a builder. These 1st contact rules have helped me and more importantly help past, present and hopefully future client/people I get to work/assist. Via Telephone: 1.      Answ…
    Transparency shows that a company is the kind of business that it wants people to think it is.
    In this seventh video of the Xpdf series, we discuss and demonstrate the PDFfonts utility, which lists all the fonts used in a PDF file. It does this via a command line interface, making it suitable for use in programs, scripts, batch files — any pl…
    This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor ( If you're looking for how to monitor bandwidth using netflow or packet s…

    794 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    16 Experts available now in Live!

    Get 1:1 Help Now