Server Limited Administrator Rights

Companies have to manage Administrator rights to their technology resources effectively. Giving everyone in an organization Administrator rights is risky and can potentially result in a huge IT security breach and other technical issues. Operating system and other software applications have mechanisms in place that allow organizations to determine who can execute full or limited Administrator rights.

The Upland AccuRoute server platform and its services support limited Administrator rights. You can set up limited Administrator rights for user accounts that need to perform specific server-related services. User accounts with limited Administrator rights cannot install or upgrade the server.

Before you begin

Plan and determine your groups, user accounts, and limited Administrator rights appropriately. You must have Administrator rights to install or upgrade the Server, Device Client, and WebApps before limiting Administrator rights for other user accounts. After completing a server installation or upgrade then limit the Administrator rights by performing the steps listed below.

Requirements

You must create an ARLimitedGroup that will have the user accounts and limited Administrator rights (permissions). You must then move the user accounts; for example, ARLimited to the ARLimitedGroup after completing the installation. The ARLimitedGroup will also be used for the Folder and Registry permissions. Any additional user accounts related to limited Administrator rights must be moved to the appropriate .ARLimitedGroup.

Note: The Group and User Account names used in the requirements and instructions are examples. Use your own group and user account names, if necessary.

Expand to view more information.

To set up limited Administrator rights

  1. Using the Active Directory Users and Computers MMC, create the ARLimitedGroup.

  2. Add ARLimited to the local Admin group.

  3. Log on as ARLimited and install the following applications.

    • Server

    • Device Client

    • WebApps

  1. Using the Windows Administrative Tools >  Services MMC, stop Upland Services.

  2. Log on as Administrator.

  3. Remove ARLimited from the local Admin group.

  4. Add ARLimited to ARLimitedGroup (Active Directory Security Group).

Note: You are adding ARLimited to ARLimitedGroupas an Active Directory Security Group.

 

  1. Add to the following local security assignments.

    • Logon as a service

    • Batch job

    • Allow logon locally

    • Act as part of the OS

Note: Ensure the Logon as a service and Batch job security assignments have not been added to the designated user account during the server installation.

  1. Add explicit permissions to the C:\Program Files (x86)\Upland Upland AccuRoute

  2. Using File Explorer, give AR Limited Group full control to the following Registry keys.

    • HKEY_LOCAL_MACHINE\Software\Wow6432Node\Omtool

    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

    • HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ComputerName

  1. Add the following groups or users to all four levels of DCOM.

    • ARLimitedGroup

    • SYSTEM

    • INTERACTIVE

 

  • Restart the system where the server is located after all steps are completed.

 

  1. Using the Server Administrator tree, select Connectors.

  2. Right-click the SMTP Connector in the Connectors details pane.

  3. Select the Properties > General > Advanced button.

  4. In the Mail Root folders section, select the Override servers default Inetpub\mailroot folder check box.

  5. Click Add. The Mail Root Folder Properties dialog box appears.

  6. Select the Ellipsis (…) button, browse, and select the default SMTP Mail Root folder.

  7. Click OK on the Mail Root Folder Properties dialog box.

  8. Click OK on the Advanced SMTP Configuration dialog box.

  9. Click OK on the Properties for SMTP on the Server dialog box.

  10. Using File Explorer, find the Intepub\mailroot folder, and give the ARLimitedGroup full control to the mailroot folder.

 

See also

About Server Services