Support 'sudoers' functionality

Description of the new feature / enhancement

The current granularity available with UAC, group policy, and NTFS permissions is lacking compared to utilizing a 'sudoers' file as supported in Linux implementations of sudo. It would be very useful for win admins to utilize 'sudoers' to further control permissions on a windows system and not grant administrative access to perform certain actions.

My perspective is more on the server side of things, but it could be useful for workstations and systems that don't have or use Active Directory.

Scenario when this would be used?

In an IT organization with multiple tiers of admins, there's a need to prevent certain admins from having Full administrative access.

• Server build team - creates builds from scratch and incorporates any organization's standards and security settings
• Server operations team - responsible for maintenance and operations (patching, resource allocation, etc) of systems. Should not be able to make changes to standards or security settings.
• Software Admin team - responsible for applications installed on the server. Can patch/upgrade software, but not windows or security patches. Should not be able to make changes to standards or security settings.

These 3 different teams currently have full admin access to a server. This can isolated with restricted groups in AD, but that still grants full administrative access to a system that a server operations or software admin team don't necessarily need.

Incorporating 'sudoers' allows granting certain folder and executable permissions to certain groups, users, or service accounts.

Supporting information

• RHEL - Managing sudo access
• Ubuntu - Sudoers

Start by reading the issue description and its RHEL and Ubuntu sudoers references. Define the required Windows model for granting groups, users, or service accounts scoped access to folders and executables, and establish how completion would be evaluated for server and workstation scenarios.