Article ID: 153716
Article Last Modified on 11/1/2006
APPLIES TO
- Microsoft Windows NT Workstation 3.5
- Microsoft Windows NT Workstation 3.51
- Microsoft Windows NT Workstation 4.0 Developer Edition
- Microsoft Windows NT Server 3.5
- Microsoft Windows NT Server 3.51
- Microsoft Windows NT Server 4.0 Standard Edition
This article was previously published under Q153716
SUMMARY
In order to perform full administration of a Windows NT Remote Access Service (RAS) server, you must be an Administrator or a member of both the Server Operators and Account Operators groups.
MORE INFORMATION
To fully administer a RAS server in a domain, you must use a user account that is a member of the Domain Administrators group, or you must use a user account that is a member of both the Server Operators and Account Operators groups.
A user in the Server Operators group is able to start and stop the RAS Server service, disconnect RAS clients, and send messages to connected RAS clients. A user who is only a member of the Server Operators group cannot grant or revoke RAS dial-in permission to a user account.
A user in the Account Operators group is able to grant and revoke RAS dial-in permission to a user account. A user who is only a member of the Account Operators group cannot start and stop the RAS Server service, disconnect RAS clients, or send messages to connected RAS clients.
A user who is a member of both the Server Operators group and Account Operators group has the same administrative abilities regarding a RAS server as a user who is a member of the Domain Administrators group.
To perform any administration of a RAS server on a Windows NT Workstation or Windows NT stand-alone server using a local machine account, the account must be a member of the local Administrators group.
Additional query words: prodnt security dun dial-up
Keywords: kbnetwork KB153716
