Changing process priorities of normal users

[Bert Sierra]

We have a Windows 2000 Advanced Server and wish to be able to adjust the
process priorities of users without adding them to the Domain Admins
group. According to
<http://www.microsoft.com/technet/prodtechnol/windows2000serv/reskit/core
/fned_ana_spmq.mspx?mfr=true>, by default only members of the Domain
Admins or Administrators groups can have their process priorities
changed.

I tried to change the security policies to allow Everyone to have their
process priorities changed. I opened "Local Security Settings >
Security Settings > Local Policies > User Rights Assignment > Increase
Scheduling Priority" and added Everyone in addition to Administrators to
have this right. I noticed, however, that in the "Effective Policy
Setting" indicator, Administrators are checked but Everyone is not.

Does this mean there is a domain-level policy in effect that is
overriding the local policy? If so, how do I go about accessing it and
changing it? I am a domain admin -- though a newbie to domain
administration (my experience is mostly with Unix and Max OS X Server).
Some tips would be helpful.

I also tried restarting the server in question, but the local security
policies I had set didn't take effect.


-- Bert Sierra, IT Manager
Fann Contracting, Inc.

 

[Roger Abell [MVP]]

We have a Windows 2000 Advanced Server and wish to be able to adjust the
process priorities of users without adding them to the Domain Admins
group. According to
<http://www.microsoft.com/technet/prodtechnol/windows2000serv/reskit/core
/fned_ana_spmq.mspx?mfr=true>, by default only members of the Domain
Admins or Administrators groups can have their process priorities
changed.

Bert
We need to clear up that there is a difference between having their
processes'
priority changed, and allowing them to change the priority of processes.
The statement in the link you reference is saying that, unless someone has
altered the user right settings, then only Administrators and Domain Admins
have permission to change process priorities.
They can change the priorities of any processes (that the system does not
guard from having its priority mucked with). It does not matter whose
processes.
This is not saying something about specifically being able to change "their
process
priorities"

I tried to change the security policies to allow Everyone to have their
process priorities changed. I opened "Local Security Settings >
Security Settings > Local Policies > User Rights Assignment > Increase
Scheduling Priority" and added Everyone in addition to Administrators to

Notice, what you did is grant to Everyone the user right to change process
priorities - any processes. This did not do what you state you did.

have this right. I noticed, however, that in the "Effective Policy
Setting" indicator, Administrators are checked but Everyone is not.

Does this mean there is a domain-level policy in effect that is
overriding the local policy? If so, how do I go about accessing it and

Yes, it probably does mean that the setting is under the control of a
GPO that applies to the machine you are considering.

changing it? I am a domain admin -- though a newbie to domain
administration (my experience is mostly with Unix and Max OS X Server).
Some tips would be helpful.

Get GPMC (from links at
www.microsoft.com/gp
and install on an XP or W2k3 in the domain. With GPMC it is much
easier to visualize the GPOs involved and there is a section for resultant
policies that you will likely find of use in this situation.

I also tried restarting the server in question, but the local security
policies I had set didn't take effect.

OK, so now I need to ask.
What is it that you are attempting / wanting to do ?
For the most part people are best off letting the scheduling algroithms in
the OS manage the process priorities. If you are attempting to allow
a number of your users to alter process priorities then you may be looking
at a bad experience (most users cannot appreciate the impacts of doing so).

Roger

 

[Bert Sierra]

Bert
We need to clear up that there is a difference between having their
processes'
priority changed, and allowing them to change the priority of processes.
The statement in the link you reference is saying that, unless someone has
altered the user right settings, then only Administrators and Domain Admins
have permission to change process priorities.
They can change the priorities of any processes (that the system does not
guard from having its priority mucked with). It does not matter whose
processes.
This is not saying something about specifically being able to change "their
process
priorities"

Roger --

Thank you for responding. What I am trying to do is to allow
Administrators the right to adjust normal users process priorities (by
normal users, I mean those who are not Administrators). We noticed that
unless a user was part of the Domain Admins group, Administrators could
not downgrade their process priorities when they were running
CPU-intensive tasks. In other words, an Admin did not have control of
User U's process priorities unless User U was a member of Domain Admins.

It seems that there is something preventing normal users from having
their process priorities changed, even by Administrators, and I'm not
familiar enough with Win2K server administration to know where this
would be set.

Notice, what you did is grant to Everyone the user right to change process
priorities - any processes. This did not do what you state you did.

I see the distinction now. In effect, anyone should be able to adjust
process priorities now. On the servers, however, it's clear that no one
(including Administrators) can adjust process priorities, so there must
be a separate setting blocking that privilege elsewhere.

Yes, it probably does mean that the setting is under the control of a
GPO that applies to the machine you are considering.

Get GPMC (from links at
www.microsoft.com/gp
and install on an XP or W2k3 in the domain. With GPMC it is much
easier to visualize the GPOs involved and there is a section for resultant
policies that you will likely find of use in this situation.

OK, so now I need to ask.
What is it that you are attempting / wanting to do ?
For the most part people are best off letting the scheduling algroithms in
the OS manage the process priorities. If you are attempting to allow
a number of your users to alter process priorities then you may be looking
at a bad experience (most users cannot appreciate the impacts of doing so).

Roger

The bottom line is that we have a server with a somewhat overloaded CPU.
We plan to purchase a faster server in the next couple of months, but
until that happens we're trying to prevent CPU-intensive users from
starving out other users. Most users use a financial package which
isn't particularly CPU-intensive. Every so often, though, one of our
users needs to run a major export of data from another app into Excel
form, which also launches an Excel task. The combination of that other
app plus Excel pegs the CPU for up to ten minutes at a time, starving
the accounting users (the bulk of our users).

We want Administrators to have the ability to lower the exporting and
Excel processes to the lowest priority during the export process. We've
found this makes for a healthy experience for all our users. We find we
can't do that unless we make the exporting user a member of the Domain
Admins group.

Thanks for all your help. I hope you'll be able to reply again.


-- Bert Sierra, IT Manager
Fann Contracting, Inc.

 

[Roger Abell [MVP]]

Thank you for responding. What I am trying to do is to allow
Administrators the right to adjust normal users process priorities (by
normal users, I mean those who are not Administrators). We noticed that
unless a user was part of the Domain Admins group, Administrators could
not downgrade their process priorities when they were running
CPU-intensive tasks. In other words, an Admin did not have control of
User U's process priorities unless User U was a member of Domain Admins.

It seems that there is something preventing normal users from having
their process priorities changed, even by Administrators, and I'm not
familiar enough with Win2K server administration to know where this
would be set.

OK, it is clear now what you are seeing and what you are wanting to do.
However, I have no idea why you are seeing what you report.
I have not ever noticed a setting that would address what you experience,
at least not one that clearly indicates it would have that effect.

Basically, an admin can change priority of processes running in context
of a Domain Admin account, but not when they run in other contextx.

Why is that?

Roger