Secure WSUS Administration

hello,

we have run issue our wsus deployment of server have been assigned multiple groups should not sharing.  there shy of 500 servers int wsus console , 45 different groups.  has had have change member ship of these servers.  there many domian administrators access servers on our domains, there way in wsus or group policy restrict users may access wsus management console specific wsus server wether @ server console or remote mmc connection?

i have looked through wsus deployment guide not found answer question.

thank you

carl

is there way in wsus or group policy restrict users may access wsus management console specific wsus server wether @ server console or remote mmc connection?

access wsus management console controlled membership in local\wsus administrators local group or local\administrators group on wsus server. extension, includes domain\domain admins, member of local\administrators group. if need restrict access wsus persons domain admins, should:

[1] ensure wsus not installed on shared purpose machine (otherwise, may not able restrict domain admins having full privileges on machine).
[2] remove domain\domain admins group local\administrators on wsus server.
[3] create domain\wsusadmins security group , add appropriate domain accounts group.
[4] add domain\wsusadmins security group local\wsus administrators group.
[5] ensure named individuals have membership in local\administrators group -- ideally local\administrator account.
[6] restrict access (by changing , controlling) password local\administrator account.

---

lawrence garvin, m.s., mcitp:ea, mcdba
principal/cto, onsite technology solutions, houston, texas
microsoft mvp - software distribution (2005-2009)
mvp profile: http://mvp.support.microsoft.com/profile/lawrence.garvin
blog: http://onsitechsolutions.spaces.live.com

Windows Server  >  WSUS