DEV Server Least Privilege for Administrators

sco gordo 301 Reputation points
2020-12-07T16:23:13.53+00:00

I'm aware that "Least Privilege" and "Administrator" are oxymoron-ish, but I want to allow certain users Admin server access EXCEPT to run services using their own account.
What are the settings to apply?
Thanks

Windows Server 2016
Windows Server 2016
A Microsoft server operating system that supports enterprise-level management updated to data storage.
2,368 questions
Windows Server 2012
Windows Server 2012
A Microsoft server operating system that supports enterprise-level management, data storage, applications, and communications.
1,526 questions
0 comments No comments
{count} votes

2 answers

Sort by: Most helpful
  1. Xiaowei He 9,871 Reputation points
    2020-12-08T08:45:58.103+00:00

    Hi,

    but I want to allow certain users Admin server access EXCEPT to run services using their own account.

    I'm not clear about your requirements in the above description.

    Do you want the user to use the common user account to manage certain services instead of Administrator account?

    If so, as far as I know, some service has its management group, like DNS service, Hyper V service, etc, we may add the user account to the certain group to manage the service.

    Thanks for your time!
    Best Regards,
    Anne

    -----------------------------

    If the Answer is helpful, please click "Accept Answer" and upvote it.

    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

    1 person found this answer helpful.
    0 comments No comments

  2. sco gordo 301 Reputation points
    2020-12-08T19:23:13.087+00:00

    Thank you, XiaoweiHe.

    Clarification:

    On the server, I need to prevent a user to be able to set up a service to run under his/her credentials , like

    46365-serviceexample.png

    The user would have to use, for example, contoso\ServiceDuplicati, or request someone with the ability to do so review and configure .

    0 comments No comments