Group Policy to Allow Non-Administrative Users to View All User Processes in Task Manager

Hi All:
Trying to get users with just Remote Services right (can remote in, no administrative permissions what-so-ever, to have the ability to view all processes by all users on the server.
I would like to do through group policy, however I cannot seem to find a policy doing just this. Any ideas?
2008 R2 Forest btw.

Hi,
Thank you for posting in Windows Server Forum.
The connection permissions that are set in Remote Desktop Session Host Configuration also determine the actions that a given user can perform in Remote Desktop Services Manager. For example, a user must have at least the Remote Control special access permission
to remotely control a user session by using Remote Desktop Services Manager.
Please check below article for details.
Configure Permissions for Remote Desktop Services Connections
http://technet.microsoft.com/en-us/library/cc753032.aspx
In regards to viewing process on RDSH server, can view the process in process Tab in RDSH manager.
Managing Users, Sessions, and Processes
http://technet.microsoft.com/en-us/library/cc732808.aspx
Hope it helps!
Thanks.
Dharmesh Solanki

Similar Messages

Allowing non-Administrator "Users" to use AEBS (1)

I'm getting tired of always having to "Authorize" other "Users" on my computer without Administrator Privilege when they wish to connect to my "Closed" AEBS. How can I work around this issue so all "Users" can conect to the AEBS?

It seems that I have originally stated the happenings incorrectly. It should been titled.
Allowing non-Administrator (or Standard) "Users" to use the Airport Card freely
I am both the 'Administrator' and the 'User' in this scenario.
I log in as the 'User', without "Allow user to Administer this computer" checked in System Preferences. This is for enhanced security while surfing at home and also when using open networks on the road. This way an Authentication by the Administrator is required every time when changes to Mac OS X are about to occur.
And, as far as I am aware, MY 'User' keychain has all the passwords I need to do what I need to do.
It's when I am logged in as the 'User' and I go to 'Turn Airport on' (in the Apple Menu) that I get the 'Authenticate' window asking me to "Type an Administrator's name and password to make changes to Mac OS X".
How do I get around having to 'Authenticate' every time 'User" needs to turn the Airport on?

Allowing non-administrator users to deploy workflows

I need to allow users who do not have admin group access on the server to deploy workflows. How can I do this? Is there a group to which I add them (_pcastserver didn't work)? Ideally, I would like to enable persons in a few Active Directory groups to deploy workflows, but if they need to be individual user IDs, that's (marginally) acceptable.
Thanks,
Charles

From our Apple Sales Engineer:
"The closest thing to allowing non-administrators to be able to submit workflows would be to configure users or groups as Podcast Producer administrators only. They would then be able to submit workflows, and however be able to configure Podcast Producer within Server Admin.
Server Admin --> Server --> Access --> Administrators --> Podcast Producer
Add a user or group and grant the ability to administer. They will not have the ability to administer the server or escalate to root privileges."
These users still have access to Administer Podcast Producer with Server Admin though.

Allowing non-Administrator "Users" to use AEBS (2)

I'm getting tired of always having to "Authorize" other "Users" on my computer without Administrator Privilege when they wish to connect to my "Closed" AEBS. How can I work around this issue so all "Users" can conect to the AEBS?

The problem lies in that the password for the Airport Network is stored in your personal Keychain, not in the system keychaing (which is a shared keychain for all users) Here is how to resolve this:
1. Open Keychain Access (/Applications/Utilities/Keychain Access
2. In the bottom left corner of the Keychain Access window there should be a button that says Show Keychains. Press it. If it says Hide Keychains then do not press it.
3. In the left column of the window, you should now have 2 boxes, the top one showing "Keychains", the lower one showing "Category" (If not, press Show Keychains again.)
4. You should have at least 2 keychains listed int he top box. One ill be called System, and the other will be called either login, or your username. If you don't see the system keychain here, you need to go to the edit menu and choose Keychain List, click the little plus sign at the bottom of the box and locate your system keychain (/Library/Keychains/) Do NOT click the check box next to your keychain. This will share your keychain, and it is not something you want to do.
5. Now that you have the System Keychain and your keychain at the top of te window, click on your keychain. The right pane will now have a listing of the contents of your keychain. Locate the password for your Airport Network. It will have the "Applications" Icon (the "A" made up off the ruler, pencil and paintbrush" and will be named after the SSID of your airport netowrk (whatever your network is named) Unnder "Kind", it will say "AirPort network password"... NOT "AirPort base station password".
The base station password is the password you use to log into the base station to configure the network. Not what you want. Find the one that says "AirPort network password"
6. Drag this to the keychain named "System" in the left column.
Type in the password for your Keychain
Now... when you look at the system keychain you should see your airport netowrk listed there. Anybody should be able to access your airport netowrk from any account on your mac.
Hope that helps.

Allow a windows non-administrator user to run cmd.exe as administrator without sharing administrator password with the user

I have standalone Windows 2003 and 2008 Oracle database servers (they are not in a Windows domain environment ). The Oracle DBAs can perform all their routine activities from command line with administrator privileges. For this i've to either share administrator
user password with the Oracle DBAs or add their windows login user to Administrators group. If i can give the DBA user permission to run windows command prompt without sharing administrator password, i can give them non-administrator login access to Windows
2003/2008 server. Normally when a non administrator user would try to run a program as administrator on Windows 2008, the user is prompted to input administrator username/password. Is it possible to give non-admin user access to run a program/application (cmd.exe
in this case) on Windows 2003/2008 without sharing administrator credentials with them?

With the OTORISER application I developed, normal users can run applications with admin privilege …
Otoriser is totally free ! Applications, mmc consoles, control panel cpl files can be run under admin and system context with Otoriser. Let’s say you donot want your users to be admin in their machines, but want them to run some applications with admin rights.
If this is the case then you are on the right blog.
There are two components for Otoriser. Management and client components. There are no complex implementation and no frustrating steps to be performed. Within 10 minutes you can start testing the results
After you download the setup files, install client components in the client by running it directly (or any deployment method you have), it will take about 5 seconds to install it. Then, let’s say you want your user to change system properties of the machine.
With the tool provided in Admin package produce the hash of system.cpl file and enter that hash into the group policy (details are provided in documentation). When policies are applied for that user then he or she can run that control panel applet under admin
context but donot forget that the user is still an ordinary user.
download link :
http://burakuysaler.wordpress.com/2013/02/21/with-the-otoriser-application-that-i-developed-normal-users-can-run-applications-with-admin-priviledges

Allow Non-Admin Users Update Software Installed In Their Computers

Hello All;
At our location, we have several users who are not always in the office. In some instances, the imac or macbook pro ask for several updates such as Office 2011, and Adobe CS 5 and 6. And, the second issue, these users are not part of the administrator group or ever will be the administrator of their computers.
Is it possible to adjust the authorization file to allow non-admin users to run these sort of updates?
or
Is there a product on the market that can push updates to all these different programs?
Thanks Kindly

Is there a product on the market that can push updates to all these different programs?
Apple Remote Desktop, for one.

App is getting damaged when I replace it as non-administrative user

Hey people,
When I want to update e.g. VLC Player, as an administrator, it is simple: I just download the dmg, mount it and drop the new version of the VLC.app into the Applications folder to replace the old VLC.app. Few days ago I created a new admin account and changed my old account to normal user. If I want to install new software that I did not use before, everything works as expected: when I drop an .app package into the Applications folder, I need to type in the admin login and password to allow this operation, then the package will be copied and I can start the new app.
My problem:
If I want to update the software by replacing the app as non-administrative user, the system first will promt me to keep both files, replace an older one or to stop - so far so good. BUT, when I select to replace, the copying process actually begins before the administrator prompt and it results in corrupted file. I also tried to create a new user account. So then I need first to remove the broken app (admin prompt once again) and then to install the new one (3rd admin prompt).
I attached some screenshots to visualize the issue. I have the same issue on two different macs with different user/admin names. I hope you have any idea how can it be fixed.
1. I download the package:
2. Mount the package:
3. Drag the VLC app to the Applications folder (selecting >Authenticate in the prompt)
4. Copy prompt (>Replace):
5. Authenticate with administrative user
6. Error message:
7. Corrupted file:

Thanks, you helped me. I had gotten hung up on '--user = <vboxuser>' in the ExecStart line, which works for one of my other services, but not this one.

Performance Tuning for non Administrator users

Hi,
Since i had performance issue on my cube i have followed tutorial:
http://www.oracle.com/technology/obe/obe_bi/bi_ee_1013/aggpersist/aggpersist.htm
to obtain best performance using aggregate tables.
All works, but opening NQSQuery.log i've seen that only Administrator User uses aggregate tables, and not other users. In fact:
Administrator User:
WITH
SAWITH0 AS (select sum(T209.SPESA_PRES0000004A) as c1,
T202.Sesso00000057 as c2
from
SA_Nominat00000090 T202, (Aggregated table)
ag_Fatti T209 (Aggregated table)
where ( T202.Nominativo0000005F = T209.Nominativo0000005F )
group by T202.Sesso00000057)
select distinct SAWITH0.c2 as c1,
SAWITH0.c1 as c2
from
SAWITH0
Other user:
WITH
SAWITH0 AS (select sum(T32.SPESA_PRESCRITTA) as c1,
T32.ASSISTITO__SESSO_LVLDSC as c2,
T32.TEMPO_DIM_ANNO_LVLDSC as c3
from
STORDO_CUBE_CUBEVIEW T32
where ( T32.TEMPO_DIM_LEVEL = 'ANNO' and T32.ASSISTITO__LEVEL = 'SESSO' )
group by T32.TEMPO_DIM_ANNO_LVLDSC, T32.ASSISTITO__SESSO_LVLDSC)
select distinct SAWITH0.c2 as c1,
SAWITH0.c3 as c2,
SAWITH0.c1 as c3
from
SAWITH0
How can I do to obtain a query similar even for a non Administrator User?
However, in your opinion, to have a TOTAL level for all dimensions, can me help to improve performances?
p.s. In addition, aggregate measure value is wrong. It's 900, but it must be 300, infact the total of all rows in fact table is 300 and not 900. In this way, even the report result is wrong!!! Why?
Thanks
Giancarlo
Edited by: user5380662 on 10-mag-2010 4.44
Edited by: user5380662 on 10-mag-2010 5.47

Hi daqstudent,
What versions of Windows (with service packs), LabVIEW, and the DAQmx
drivers do you have? It looks like this issue should have been
fixed in DAQmx version 7.4. As a work-around, you should be able
to use the Measurement & Automation Explorer (MAX) to create
DAQmx Global Channels, and then use those saved Global Channels in LabVIEW. The
configuration for DAQmx Global Channels in MAX is the same as that of
the DAQ Assistant in LabVIEW. The only experience lost is seeing the
actual DAQ Assistant icon in LabVIEW.
Thaison V

Allowing non-admin users to use certain programs without authenticating

I would like to allow certain programs to be run by non-admin users without forcing them to authenticate as an admin. Here is my example: I'm running Parallels Desktop with a VM to Windows. I want to allow my children to use this VM to access Windows programs. But, when starting a VM, the Mac OS requires an administrator to authenticate. Needless to say, I don't want my children to be administrators on the machine. I've been assured that this is not an issue related to how Parallels works (from the support team at Parallels). Instead, this is an issue with the Mac. i'm not sure one way or the other, but it seams useful to be able to (in general) allow non-admin users to use certain programs without forcing them to authenicate as administrators.
There is only one summary in the Mac help on allowing non-admin users to change the time zone settings by directly editing the /etc/authorization file. Does anybody know if this procedure would work for other programs?
Thanks!

If you know what the requested right is, that procedure can be applied to any right in an application with a graphic interface by duplicating and modifying entries. The contents of that file don't control usage of sudo in the Terminal.
(25922)

Can Non SRM users approve SRM task from UWL ?

We have a requirement where certain task approvers who do not belong to SRM application hence they can not access SRM directly. But task item is available for there approval in Universal Work List. Can they approve the task from UWL. If not what we need to do so that non SRM users can approve task from portal Universal Work List
Thanks and Regards
Sudhir

Answered in SRM - Shopping Cart Forum.

Having problem with svchost.exe/ntdll.dll errors causing GPSVC (Group Policy Client) to crash preventing users from logging into the server.

Recently (within the past 2 weeks) I have noticed a few of our servers will have problems with the svchost.exe application causing the GPSVC (Group Policy Client) to crash. The only fix at that point is to reboot the server since the GPSVC service is tied
to svchost.exe and therefore is protected from being manually restarted.
I noticed the following errors when this occurs:
Log Name: Application
Source: Application Error
Date: 7/23/2013 4:35:26 AM
Event ID: 1000
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: Server1.xxx.xxx.net
Description:
Faulting application name: svchost.exe, version: 6.1.7600.16385, time stamp: 0x4a5bc3c1
Faulting module name: ntdll.dll, version: 6.1.7601.17725, time stamp: 0x4ec4aa8e
Exception code: 0xc0000024
Fault offset: 0x00000000000cd7d8
Faulting process id: 0x46c
Faulting application start time: 0x01ce877f9476ac07
Faulting application path: C:\Windows\system32\svchost.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: d252d26d-f372-11e2-8ad4-005056ac00e8
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2013-07-23T08:35:26.000000000Z" />
<EventRecordID>158950</EventRecordID>
<Channel>Application</Channel>
<Computer>AAW19XM2.agency.nwie.net</Computer>
<Security />
</System>
<EventData>
<Data>svchost.exe</Data>
<Data>6.1.7600.16385</Data>
<Data>4a5bc3c1</Data>
<Data>ntdll.dll</Data>
<Data>6.1.7601.17725</Data>
<Data>4ec4aa8e</Data>
<Data>c0000024</Data>
<Data>00000000000cd7d8</Data>
<Data>46c</Data>
<Data>01ce877f9476ac07</Data>
<Data>C:\Windows\system32\svchost.exe</Data>
<Data>C:\Windows\SYSTEM32\ntdll.dll</Data>
<Data>d252d26d-f372-11e2-8ad4-005056ac00e8</Data>
</EventData>
</Event>
All of our servers are running Server 2008 R2 Enterprise where we use Citrix to deliver desktop sessions to our users, but some are virtual and some are physical. This seemingly impacts our virtual machines more, and our VMs are hosted through VMWare, however,
about 5 months ago a similar error fired on a non-virtual machine:
Log Name: Application
Source: Application Error
Date: 2/27/2013 6:57:58 AM
Event ID: 1000
Task Category: (100)
Level: Error
Keywords: Classic
User: N/A
Computer: AAW29033
Description:
Faulting application name: svchost.exe_gpsvc, version: 6.1.7600.16385, time stamp: 0x4a5bc3c1
Faulting module name: ntdll.dll, version: 6.1.7601.17725, time stamp: 0x4ec4aa8e
Exception code: 0xc0000024
Fault offset: 0x00000000000cd7d8
Faulting process id: 0x6c0
Faulting application start time: 0x01ce14e1af313fd9
Faulting application path: C:\Windows\system32\svchost.exe
Faulting module path: C:\Windows\SYSTEM32\ntdll.dll
Report Id: ed3d01c4-80d4-11e2-9128-b499baa9e5e8
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Application Error" />
<EventID Qualifiers="0">1000</EventID>
<Level>2</Level>
<Task>100</Task>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2013-02-27T11:57:58.000000000Z" />
<EventRecordID>286291</EventRecordID>
<Channel>Application</Channel>
<Computer>AAW29033</Computer>
<Security />
</System>
<EventData>
<Data>svchost.exe_gpsvc</Data>
<Data>6.1.7600.16385</Data>
<Data>4a5bc3c1</Data>
<Data>ntdll.dll</Data>
<Data>6.1.7601.17725</Data>
<Data>4ec4aa8e</Data>
<Data>c0000024</Data>
<Data>00000000000cd7d8</Data>
<Data>6c0</Data>
<Data>01ce14e1af313fd9</Data>
<Data>C:\Windows\system32\svchost.exe</Data>
<Data>C:\Windows\SYSTEM32\ntdll.dll</Data>
<Data>ed3d01c4-80d4-11e2-9128-b499baa9e5e8</Data>
</EventData>
</Event>
I've searched and cannot seem to find any information as to what may be causing this, or even really where to start. Would someone be able to help me identify what might be causing this event, specific with the Exception code: 0xc0000024, which causes
the Group Policy Client service to stop?

You still out there looking at things? If so I have an update. The issue hasn't stopped, even though it did seemingly die down for awhile, however, it is now back with a vengeance.
I am able to force it to happen by killing the svchost process that is hosting GPSVC. If I run gpupdate /force, then logout/login it does get GPSVC running again. Furthermore, if I simply start svchost again via the Task Manager GPSVC starts running again.
When I access the server remotely with KVM it acts just like it does as if I'm logging into it via Citrix/RDP which for Admin IDs gives an error saying "Failed to connect to a windows service. Windows could not connect to the Group Policy Client service...",
however, normal user accounts just get a message when logging into the server "The Group Policy Client Service Failed the Logon. Access is denied."
I haven't opened a case with Microsoft yet, but we about ready to because of the increase in these errors.
If you have any further suggestions that would be great, otherwise I'll provide an update once I get word back from Microsoft.
**EDIT -- apparently I mistook the the server's SCM's actions as my own. I was able to successfully crash the GPSVC service by killing the hosting svchost process, however, after I crashed it and let it sit crashed for awhile when I attempted
to restart either by starting a svchost task, or running gpupdate /force it failed. Either that, or there is a timing issue where if we don't restart the svchost process, or run gpupdate /force quickly enough it won't be able to recover without a reboot.

How to allow non-admin users to install software updates of Java, FLASH and Adobe Reader?

Hi all,
I have a company (+150 users) and I would like to allow users to update Java, FLASH and Adobe Reader only.
These software are already installed in the hosts, but there are updates of the program every week and it needs to be updated.
How can I give permissions to every user in the domain to do that? Just "Java, FLASH and Adobe Reader"
Remember that I dont want distribute software because they were installed.
I tried to enable "Enable user to patch evelated products" directive but it didn't work at my domain.
is it possible?

I have a method that works for FLASH player, but am trying to come up with a method for the other 2 myself. To automate flash player, I created a Policy and added the following:
Under Computer Config, Prefrences, Windows Setting, Files I created a new File Item.
I set Action = Replace, Created a Source File named mms.cfg* (more below) and have the destination file as systemroot%\System32\Macromed\Flash\mms.cfg (or %systemroot%\SysWOW64\Macromed\Flash\mms.cfg for x64)
I used notepad to edit the mms.cfg, and used the following in the body:
AutoUpdateDisable=0
SilentAutoUpdateEnable=1
AutoUpdateInterval=0
My non-admin users now update flash in the background silently and automatically.

NI Update Service and non-administrative user

On my Windows 7 PC I have 2 different users:
a local Administrator user who can install application but can't navigate to the web (for security reasons)
an User who can't install anything but can navigate to the web
I launch NI Update Service under User account and it shows a list of available updates.
I select one or more of these updates and I click on "Install" button
Is asks me for the Administrator password, but then it gives a communication error with NI...
Does it use Administrator user to download the updates?
It should use it only to install and not to download
Vix
In claris non fit interpretatio
Using LV 2013 SP1 on Win 7 64bit
Using LV 8.2.1 on WinXP SP3
Using CVI 2012 SP1 on Win 7 64bit, WinXP and WinXP Embedded
Using CVI 6.0 on Win2k, WinXP and WinXP Embedded

Yes, I tried but if I select "Run as administrator" Windows asks me for credential of an administrator account.
I enter username and password, but my administrator account can't communicate to the web and so I get the error in the attached image (comm_err.jpg).
As I wrote, I think that the problem is that NI Update Service uses the administrator user not only to install the programs but also to download them from the NI servers.
I don't think this is OK because as shown in the attached install.jpg the button with the administrator shield is "Install", but after I click on it and enter the administrator credentials, NI Update Service tries to download the selected programs.
But with my administrator user this is not allowed.
It should download them with the user that launched it (with this user it is able to find the list of available updates) and use the administrator user only to install.
Could someone from NI confirm that this is the behavior of NI Update Service, please?
Vix
In claris non fit interpretatio
Using LV 2013 SP1 on Win 7 64bit
Using LV 8.2.1 on WinXP SP3
Using CVI 2012 SP1 on Win 7 64bit, WinXP and WinXP Embedded
Using CVI 6.0 on Win2k, WinXP and WinXP Embedded
Attachments:
comm_err.JPG ‏27 KB
install.JPG ‏63 KB

How do I fix a problem group messaging with one non-iphone user and several iphone users?

My brother switched from an iphone to another smart phone several months ago. The rest of our family all have iphones. When he made the switch, my sister suddenly had problems with group messages going through for him--they went through as imessages for her instead of SMS or MMS. I didn't have that problem until a few days ago. I upgraded to an iphone 6 about a week ago, and group messaging my brother worked fine at first, and then a couple of days ago, suddenly stopped working. If I am texting him singly, it's fine. But in group texts, it automatically sets at imessage.
He has called apple and his number is completely deregistered with imessage. Does anyone know what else we can try? I have deleted all previous messages that were imessage and deleted and re-entered him as a contact.

I'm assuming neither of you heard back from anyone? I'm having the same issue - just in the last few days. The non-iphone user is not receiving texts from the group message because it is sending as an imessage. It flipped to imessage randomly last week. I've tried to delete the group message and restart it; same issue. Would love to hear how to resolve, Apple!

Windows Server 2012 Group Policy Block USB Storage devices @ User Level Not getting applied on a Domain Client machine with Windows Server 2008 R2. Why?

Hello,
I have a Windows Server 2012 R2.
I have configured the Group Policy on it to block the usage of USB - Storage Devices @ user level on the client machines. It works properly for my Windows 7 client machines but it's not working on one of the machine having Windows Server 2008 R2 installed
on it (this machine is also a domain client in the same domain).
I will really be thankful if anyone can suggest some solution to this issue.
Please feel free to write back in-case I have missed anything obvious to be shared.
Thanks!
-Vinay Pugalia
If a post answers your question, please click "Mark As Answer" on that post or
"Vote as Helpful".
Web : Inkey Solutions
Blog : My Blog
Email : Vinay Pugalia

Hi,
Any update?
Just checking in to see if the suggestions were helpful. Please let us know if you would like further assistance.
Best Regards,
Andy Qi
TechNet
Subscriber Support
If you are TechNet
Subscription user and have any feedback on our support quality, please send your feedbackhere.
Andy Qi
TechNet Community Support

Group Policy to Allow Non-Administrative Users to View All User Processes in Task Manager

Similar Messages

Maybe you are looking for