Windows Forum

Ask something
Discussion Locked

NT domain and 2K/XP client PC's

0 helpful
7 replies

by pc_tek 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Our NT 4.0 domain controller is responsible for scripting necessary drive maps to domain users. Our scripts also push other critical enterprise network settings that can only be obtained during log in.

One of the drive maps is a share that allows users to access windows security patches/updates and install them as directed. Our users do not have Internet access. All domain users can access this folder, but only the 9x clients can install the updates/patches successfully, the 2K/XP clients receive ?You do not have permission to update windows. Contact your system administrator? and cannot complete the update process.

We know one fix for this is to have the 2K/XP users log on locally to their PC rather than directly to the domain. This allows them to inherit the necessary rights to complete the update, but unfortunately logging on locally defeats the drive scripting and required network settings push that is received from logging into the domain. We have discussed the idea of going to all 2K/XP clients and mapping their drives manually and still allowing them to log on locally, but for many reasons this is not practical and will not work for our network environment.

My question is this: Does anyone know if there is a way of setting the NT domain security settings (Per user/group) so that they will inherit the appropriate rights to install the updates, or (2) is there something we can do on the 2K/XP client side that will allow them appropriate rights to update their own systems while at the same time logging into the domain rather than locally.

Any suggestions on this would be greatly appreciated.

Thanks in advance.

7 replies

by 93961

Make the domain user using the machine/client node member of the local (Machine) domain administrators group. This will allow to install the patches\updates as he will be having the administrative rights for his local machine domain.

by gigelul

If you don't have more than 50 computers, you can try this tool:
http://www.shavlik.com/
The HFNetChkPro is free for 50 computers and can patch all your computers from a management/control/admin console.
It using any credentials you wish.

by curacao_dejavu

Hi,

You can use the Microsoft Software Update Services (SUS).
http://www.microsoft.com/windows2000/windowsupdate/sus/susfaq.asp

(delete any spaces)
To update automaticly for the clients you should schedule it) as described below.
If the end user is part of the local administrators group, he or she will be able to interact with Automatic Updates (AU) by initiating downloads or installs. If the end user is not part of the local administrators group, he or she will not be able to interact with AU and will not see the AU balloon or tray icon. For end users who are not local administrators, the only way that AU will properly update their machine is if scheduled installs are set.

Think of it maybe that's also the solution to the problem you are experiencing.
If you schedule the updates and use the "run as" with the local admin account it should run.

Success Leopold

This discussion is closed to new replies.