pfreestun
Posts: 22
Score: 0 Joined: 5/9/2006 Status: offline
|
He needs no special SMS permissions, as long as he can see his PC in the SMS Console. The reason for this is that we use WMI to "connect" back into SMS and the WMI Provider is using LocalSystem. So what you actually have to do is set the WMI permissions. ---------------------------------------------------------------------------------- Open the WMI Manager. (wmimgmt.msc) Browse to in the security tab to the SMSWAK namespace. And give the user/group these security rights: "Execute Methods" & "Remote Enable" AND IF USERS CONNECT FROM REMOTE WORKSTATIONS: THIS (recommended, needs W2K3 Sp1): Open the local user and groups console (lusrmgr.msc) In the Groups there is a "Distributed COM Users", you have to put the users as members into this one. OR THIS: Open DCOMCNFG.exe then expand Component Services, right click on “My Computer” Open “COM Security” and click on “Edit Limits”. The Default is that Local Administrators and D-COM Users have the needed Remote Activation and Remote Launch permissions. Obviously your best practice should be to create a local group and add the members in there, then add this group to either "Distributed COM Users" or directly in COM Security
|