Windows 2016 Server | Manager would like access to unlock/close open files.

Question

Hello,

We have a user that would like to be able to access the server "Computer Management" to close any locked files. They have had situations where a file is open...and they don't know who does.

I would like to limit access to anything else that he can break. What are the minimum permissions the AD account would need to access Computer Management and close any open files?

Thanks in advance.

Regards,
Rudy

Answer 1

You'll need to grant local administrator permissions on the server hosting the shares.

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 2

What I have done in the past is to write my own ASPX page to perform certain administrative functions for users that are not members of the Administrators group. The key is to authenticate the user but not impersonate them and use SYSTEM for the IIS worker process account.

While your manager might need access, if you have a help desk you could add those users too.

If there is no native DotNet API to perform the desired function, then write code to shell out command line programs and capture stdout and stderr. Thay way, anything an admin can do from a command prompt can be implemented in a web page. The added benefit is that the page can also log activity so when the inevitable 'who closed my session" question gets asked you can examine the log to see who did what.