Permissions Required to Perform RAS Administration
Article ID: 153716
Article Last Modified on 11/1/2006
APPLIES TO
- Microsoft Windows NT Workstation 3.5
- Microsoft Windows NT Workstation 3.51
- Microsoft Windows NT Workstation 4.0 Developer Edition
- Microsoft Windows NT Server 3.5
- Microsoft Windows NT Server 3.51
- Microsoft Windows NT Server 4.0 Standard Edition
This article was previously published under Q153716
SUMMARY
In order to perform full administration of a Windows NT Remote Access
Service (RAS) server, you must be an Administrator or a member of both the
Server Operators and Account Operators groups.
MORE INFORMATION
To fully administer a RAS server in a domain, you must use a user account
that is a member of the Domain Administrators group, or you must use a user
account that is a member of both the Server Operators and Account Operators
groups.
A user in the Server Operators group is able to start and stop the RAS
Server service, disconnect RAS clients, and send messages to connected RAS
clients. A user who is only a member of the Server Operators group cannot
grant or revoke RAS dial-in permission to a user account.
A user in the Account Operators group is able to grant and revoke RAS
dial-in permission to a user account. A user who is only a member of the
Account Operators group cannot start and stop the RAS Server service,
disconnect RAS clients, or send messages to connected RAS clients.
A user who is a member of both the Server Operators group and Account
Operators group has the same administrative abilities regarding a RAS
server as a user who is a member of the Domain Administrators group.
To perform any administration of a RAS server on a Windows NT Workstation
or Windows NT stand-alone server using a local machine account, the account
must be a member of the local Administrators group.
Additional query words: prodnt security dun dial-up
Keywords: kbnetwork KB153716