Re: Workaround for 0x8007045A (!)

From: Tony Vaughan (TonyVaughan_at_discussions.microsoft.com)
Date: 09/20/04 

Date: Mon, 20 Sep 2004 09:15:04 -0700

Hi Torgeir

Now we know the area of the problem, I can download updates by logging off
from the domain user of the machine and logging on as administrator of the
machine. However, nothing I have tried by adding group rights to the domain
user has made WU5 work when logged on as a domain user even when the domain
user has administrator rights.

Does anyone know why this is? Bye the way, I couldn't find a group user with
NT AUTHORITY\Interactive. Shouldn't NT AUTHORITY\Authenticated Users have
been enough? It isn't obvious to me what is going on here.

Tony

"Torgeir Bakken (MVP)" wrote:

> Tony Vaughan wrote:
>
> > I've just been chatting to a mate of mine who really knows what he is doing
> > when it comes to network configuration. Now, if you used to use SBS under NT4
> > and you created a domain user for a workstation as an administrator, the
> > domain user would have full administration rights to the local machine. My
> > mistake was to think that SBS 2000 and SBS 2003 did the same even though you
> > will notice that they introduced templates. It would now seem that when you
> > create a user as a template administrator you are giving that user
> > administrative rights to the domain but not the local machine, as your
> > observation proved.
> >
> > So, what is the solution? I tried to give the domain user access rights to
> > the local machine by going into Computer Management and selecting 'Local
> > Users and Groups' and adding Domain Users to the list. However, under SP2
> > this didn't work so I am about to test this with a machine that doesn't have
> > SP2 installed. I'll let you know how that goes.
> Hi
>
> We add "NT Authority\Interactive" in the local Administrators group
> to let all domain users automatically be local admins when they log
> on to a computer interactively (works fine for SP2 as well).
>
> This is more secure than adding "Authenticated Domain users ",
> "Domain Users" or "NT AUTHORITY\Authenticated Users" (or a group
> that contains all users as you have) because you avoid the issue
> with cross network admin rights (remote access) between the
> computers that these groups introduces.
>
>
> --
> torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway
> Administration scripting examples and an ONLINE version of
> the 1328 page Scripting Guide:
> http://www.microsoft.com/technet/scriptcenter/default.mspx
>

Relevant Pages

  • Re: Windows 2000 client cant map network drive on windows server 2003
    ... the local username and/or password on the 2000 workstation that is used is ... different from both the xp pro local user and domain user; ... the local administrator account has password of admin ... when the batch file runs it uses the current credentials. ...
    (microsoft.public.windows.server.networking)
  • Re: Unable to login to Win XP Pro Notebook
    ... > administrator, I could could lose some files if they exist, especially the ... are the user's EFT files o.k.? ... Here's an overview of EFS. ... unencrypt any files encrypted by a domain user. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: TS users cannot set default printer
    ... following registry key did not exist: ... It has to do with some windows update, ... > When I log on to the TS as 'Administrator', ... When I logon as any Domain User, ...
    (microsoft.public.win2000.termserv.clients)
  • RE: SBS /xp desktop settings
    ... I do get an error message it says:- ... You want to retain the desktop setting for domain user ... >> or just outlook setting for the domain user or some other setting for the ... Does it occur to all the non administrator user or only some user? ...
    (microsoft.public.windows.server.sbs)
  • Re: Workaround for 0x8007045A (!)
    ... works if you log on to the administrator account of a workstation attached to ... in a fit of social conscience that might help other WU5 ... domain account under previous versions of SBS were now missing. ... on as domain user and WU5 doesn't work. ...
    (microsoft.public.windowsupdate)