Check windows updates on windows 2003 server with a server operator account

Question

On Windows 2003 Server: I know that for installing security windows updates you need an administrator account, but, exist any way to check for updates with an server operator account (or another account with less privileges than administrator)?

Thanks!

Solution 1

Looks like Microsoft requires administrative rights to install on an XP workstation. So I doubt they would have anything less for a server.

The manual installation of operating system updates from the Microsoft Update Web site requires the operating system desktop to run with administrative rights http://technet.microsoft.com/en-us/library/bb456992.aspx

I would look into getting a WSUS server. You would be able to pull a lot of reports for all your servers (and workstations) through that.

Solution 2

Server Operators is a group of limited usefulness. It only exists on domain controllers, and only enables a member to perform a small number of specific functions. Installing updates requires Administrator permission to a much wider scope of the file system and registry, and elevated privileges.

Additionally, Server Operators is a 'protected group'. Windows further restricts access to the members of protected groups, which can lead to unusual and difficult to solve permissions, delegation, and inheritance issues. I would discourage using Server Operators, Account Operators, or Backup Operators.

More information:

Well-known security identifiers in Windows operating systems
http://support.microsoft.com/kb/243330

Delegated permissions are not available and inheritance is automatically disabled
http://support.microsoft.com/kb/817433