|
Posted by Roger Abell [MVP] on July 25, 2006, 9:45 am
Please log in for more thread options Bruce,
We need to factor apart what you appear after.
One is to use task manager to view all processes. This appears to be
something hardcoded into task manager as allowed only to admins.
However, if you are willing to use other tools, for example fromt the
PStools suite from www.sysinternals.com (now part of Microsoft)
then you will find that they do not have this restirction.
You also seemed to what to grant the ability for a non-admin account
to access/kill arbitrary processes. I do not believe that there is a
specific user right for that tightly defined purpose. I would also try
debug priv, possibly with load/unload drivers, and if those are not
sufficient then act as part of OS. Any one of these is an unsafe grant
that would allow the account with them to elevate they privs to full
admin, to destabalize the OS, to install code of choice, etc..
Roger
> Thanks for the reply, Svyatoslav!
>
> I tried granting a user both the "increase scheduling priority" and "debug
> programs" "right" under Security Settings, Local Policies, User Rights
> Assignment (in Computer Configuration) via GPO to a specific domain user,
> but that user still could not add a check mark to the "Show processes from
> all users" check box in Task Manager.
>
> I verified using gpresult /v that the settings in the GPO had been
> applied to the computer.
>
> Any other ideas come to mind?
>
> It may well be that there is no specific right or permission that grants
> this - this ability may be built-in to the Administrators group inherent
> rights (unfortunately!) but it would be nice to know definitively.
>
> --
> Bruce Sanderson MVP Printing
> http://members.shaw.ca/bsanders
>
> It is perfectly useless to know the right answer to the wrong question.
>
>
>
>> Interesting question... That might be a matter of changing one of the
>> user rights in the local security policy. Which one? I'd say "Increase
>> scheduling priority" or "debug programs".
>>
>> --
>> Svyatoslav Pidgorny, MS MVP - Security, MCSE
>> -= F1 is the key =-
>>
>>> In Windows 2003 Enterprise Server, is there a user right or group policy
>>> setting (or other means) to allow someone to view and end processes from
>>> any (all) users (e.g. in Task Manager - "Show processes from all users")
>>> without making that someone's user account a member of the
>>> Administrators group?
>>>
>>> --
>>> Bruce Sanderson MVP
>>> http://members.shaw.ca/bsanders/
>>> It's perfectly useless to know the right answer to the wrong question.
>>>
>>>
>>>
>>
>>
>
>
| 
XML Sitemap