Power Users: can they install MS patches?

[hrp2171]

Hi,

I've been working with Microsoft's SUS Server software and Active Directory.

It works great, except that if an Admin or Admin-like user is not logged on, the patches are not made available for installation. The patches are all being downloaded to the workstations just fine. I'd hate to give Everyone in my network Admin rights to their workstations when( and if ) I can do it with just Power Users rights.

I'm still researching through Microsoft's web site and on the 'net, but if someone knows about this, I'd appreciate your input.

Thanks,

Hector

[Skyfrog]

Yes, Power Users can install drivers and certified patches. They can do many of the things that an Administrator can, except view other users profiles, add themeselves to the Administrators group, change system settings or services or install programs that change them.

[hrp2171]

Thanks for your reply.

After I started this topic, I created a Test OU, created a GPO attached to it, and added a workstation to the OU. I also created a Test User with plain vanilla rights, but in the OU's Restricted Groups setting, I made Authenticated Users part of the Power Users group.

I logged onto the workstation and a few minutes later a prompt came up telling that the updates were ready to be installed. It worked without a problem.

I also did a test to see if no one was signed on, would it just install the updates and restart the computer. It did!

Now I have 2 options:

Make all my users Power Users or

Just tell everyone to leave their computers powered on overnight and let the GPO take care of installing and restarting the computers.

This is some cool stuff when it works.