Link to home
Start Free TrialLog in
Avatar of dburk1
dburk1

asked on

Windows SBS 2008 how do I grant access to the SBS Management console so that a designated group or user can manage accounts and groups, without giving them full administrative rights?

Windows SBS 2008 how do I grant access to the SBS Management console so that a designated group or user can manage accounts and groups, without giving them full administrative rights?
Avatar of larsrohr
larsrohr
Flag of United States of America image

I believe you'll need to add such users/groups to a couple of groups accessible via Active Directory Users & Computers (not through the SBS console interface).
You may find AD U&C in your Administrative Tools menu, or within Server Manager, under Roles -> Active Directory Domain Services.

Expand your domain, and you can add your users/groups to the Builtin -> Account Operators security group.
You may also want to add them to Microsoft Exchange Security Groups -> Exchange Recipient Administrators group.  But it might be that membership in the Account Operators group already gives them all the permissions they need.
Avatar of dburk1
dburk1

ASKER

I added the user in question to the Account Operators group using Active Directory Users and Computers, and not the "Console". The user still could not use the SBS Admin Console. There must be some way to grant access to it, since the local admins have the right. It would make sense that you would need an elevated priviledge to manage accounts, but you wouldn't want these people to have the right to change the full administrator level accounts and grant themselves additional rights. Is this even possible?
ASKER CERTIFIED SOLUTION
Avatar of larsrohr
larsrohr
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of dburk1

ASKER

Good response and sourced by Microsoft articles.