We are changing some security policies around the office and are wanting to take the help desk users out of the domain admins group. However, I still want the help desk users to be able to log onto the servers and restart services and reboot servers if needed. I was planning on using the Server Operators and Account Operators builtin groups in AD, but the help desk users still cannot log into any server after being added to those groups.
What group or access do I need to give them so they can log into servers and restart services and reboot machines?
