Home / server / Questions / 613281
In Process
MrVimes
Asked: 2014-07-18 02:09:50 +0800 CST

Is there a GPO to allow standard users to access Resource Monitor

  • 772

I need to allow standard domain users to be able to access the Resource Monitor on Windows 7 without adding them into the administrators group on any local machines. Is there a domain GPO setting to allow this?

Currently if they try to access it they are prompted for administrative credentials.

I have searched within GPME and I cannot find a setting myself.

Edit I think I may not be able to do this. Resource monitor also allows processes to be stopped and started, hence the need to require elevation to start it.

windows-7

4 Answers

    1. The user needs to be a member of the local "Administrators" or "Performance Monitor Users" group.

    2. Further to this i found the user or a group the user belongs to needed the log on as a batch job and Create Global Object right.

    The key to finding this information was to enable Local Computer Policy/Computer Configuration/Security Settings/Local Policies/Audit Policy/Audit object access and set it to Audit failures, and then run resource monitor. After getting the Access Denied message, look in event viewer security log and you should find one or more "Audit Failure" events. They will point you in the right direction. You may have to enable some of the other audits to nail this one, but for me that wasn't required.

    • 2

  2. I believe you're looking for the User Rights Assignment; Profile system performance, which can be configured via GPO.

    Note that this is configured under Computer Configuration, not User Configuration as this is a right granted on a computer for a user or group of users.

    Also note that you should make note of the users/groups that already have this right so they can be "reassigned" this right when you implement the GPO setting.

    • 0

  3. You need to make the users a member of the Administrators or Performance Monitor Users group. And back in Server 2008/Vista, you had to grant the users log on as a batch job right. I don't see that prerequisite in the documentation for 2008 R2/Windows 7, but something to keep in mind in the event that adding the users to the Performance Monitor Users group isn't sufficient.

    And, of course, it is possible to add users to a local group via GPO or GPP.

    • 0

  4. Another possibility (without GPO) is using surun with a rule as in this screenshot.

    • 0