The following table contains common tasks and the permissions that are required for each.
| Task | Permissions Needed |
|---|
Add or remove an image group | Full control over C:RemoteInstall\Images\ImageGroup. |
Add or remove an image | Full control over C:RemoteInstall\Images\ImageGroup. |
Disable an image | Permission to read and write attributes for the associated image file. Disabling an image means hiding the Windows image (.wim) file associated with the image. |
Add a boot image | Read and write access to the following: - C:RemoteInstall\Boot
- C:RemoteInstall\Admin (This folder is only present if you upgrade from Windows Server 2003).
- %TEMP%
|
Remove a boot image | Read and write access to C:RemoteInstall\Boot. |
Set properties on an image | Read and write permissions to the .wim metadata file that represents the image. This file is located within the image group at: C:RemoteInstall\Images\ImageGroup. |
Prestage a computer | Permissions to create accounts in the domain, as well as write to the properties of a computer object. To grant permissions to prestage a computer - Open Active DirectoryUsers and Computers.
- Right-click the organizational unit (OU) where you are creating prestaged computer accounts, and then select Delegate Control.
- On the first screen of the wizard, click Next.
- Add the user or group you wish to delegate control to, and then click Next.
- Select Create a Custom task to delegate.
- Select Only the following objects in the folder. Then select the Computer Objects check box, select Create selected objects in this folder, and click Next.
- In the Permissions box, select the Write all Properties check box, and click Finish.
|
Approve a pending computer | Read and write permissions for the folder that contains the database file Binlsvcdb.mdb in the RemoteInstall share (for example, C:RemoteInstall\MGMT). The actual account of an approved pending computer is created by using the server’s authentication token, not the token of the administrator who is performing the approval. Therefore, in AD DS, you must grant rights to the Windows Deployment Services server’s account (WDSSERVER$) to create computer account objects for the containers and OUs where the approved pending computers will be created. To grant permissions to approve a pending computer - Open Active Directory Users and Computers.
- Right-click the OU where you are creating prestaged computer accounts, and then select Delegate Control.
- On the first screen of the wizard, click Next.
- Change the object type to include computers.
- Add the computer object of the Windows Deployment Services server, and then click Next.
- Select Create a Custom task to delegate.
- Select Only the following objects in the folder. Then select the Computer Objects check box, select Create selected objects in this folder, and click Next.
- In the Permissions box, select the Write all Properties check box, and click Finish.
|
Prestage a computer to join a domain | The user account must have permissions to join the domain. The JoinRights registry setting determines the set of security privileges, and the User registry setting determines which users have the right to join the domain. To change the per server (per architecture) defaults, you need read and write permissions to these registry keys. - The JoinRights setting is located at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WDSServer\Providers\WDSPXE\Providers\BINLSVC\AutoApprove\<arch>
Name: JoinRights
Type: DWORD
Value: 0 = JoinOnly.; 1 = Full.
A user that has Join only rights cannot join the domain without administrator assistance (an administrator with proper permissions on the computer account object must reset the computer account before the client installation and domain join).A user that has Full rights can reset the account and join the domain without administrator assistance.
- The User setting is stored at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WDSServer\Providers\WDSPXE\Providers\BINLSVC\AutoApprove\<arch>
Name: User
Type: REG_SZ
Value: Name of group or user. For this setting, there are two administration models that you can use.
- (recommended) You can associate a primary user to the account at the time the computer is approved. When the computer is approved, the computer account will grant the primary user 1) read and write permissions on all properties on the computer object (JoinRights = JoinOnly or JoinRights = Full), and 2) reset and change password rights on the computer object (JoinRights = Full).
- You can specify server defaults for the user and JoinRights that apply to all approved clients of a given architecture. The default values grant domain administrators the Full join right. If you do not assign a primary user to the computer account at the time of approval, these default values will take effect.
.gif) Note |
|---|
| If you are creating computer accounts against a non-English domain controller and you are using the default user property, you must set the Auto-Add settings to use a different account that does not contain extended characters. If the account contains a non-standard character (any character outside [A-Z, a-z, 0-9, \, -, and so on]), such as German's "Domänen-Admins", then Auto-Add will fail. To change this value, see the help at the command prompt for WDSUTIL /set-server /AutoAddSettings. |
|
Convert a RIPREP image | - Read and write permissions to the %TEMP% directory and destination location
- Read permissions on the original RIPREP image
|
Create a discover or capture image | - Read and write permission to the %TEMP% directory and destination location
- Read permissions on the original boot image
|
Create a multicast transmission | - Full control over the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WDSServer\Providers\Multicast
- Read permissions to RemoteInstall\Images\ImageGroup.
|
Modify a multicast transmission (for example, delete, deactivate, start, stop, disconnect, and so on) | Full control over the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WDSServer\Providers\Multicast |