I am almost finished with the exhaustive summer task of transitioning a Server 2003 network with four servers, SQL 2005, and Exchange 2003 to Server 2012, Exchange 2013 and 2014. There's been no end of undocumented bugs and glitches along the way. However, it seems that Microsoft has saved the best for last.

The final task is getting WSUS set up.  As per usual, what should have been a straightforward role installation has run into an undocumented brick wall that was inevitable.  (If it happens on a fresh install of Server 2012, you KNOW that they didn't beta-test it.) 

I found a third party description of the EXACT problem that I'm having, along with the solution:

WSUS Role failed on Windows server 2012 with error the operation cannot be completed because the server that you specified requires a restart

The solution is to add the "log on as a service" right to NT SERVICE\ALL SERVICES in the group policy management console.  The author provides nice illustrations of the steps to take. 

Here's where my frustrations really peak.  This is HIS Server 2012 (not R2) group policy management console:

And this is MY Server 2012 group policy management console:

No "user rights assignment" section.  There's a "delegation" tab, but you can't add NT SERVICE\ALL SERVICES to it -- you get "not found" for both the local machine and the domain.  Can anybody tell me how to accomplish what the author accomplished using the limited group policy console I have or a powershell script?

When you define the settings for Log on as a service and you click Add User or Group, simply Type NT SERVICE\ALL SERVICES in the User and group names box. Don't click browse.  When you apply the policy to the server it will apply it just as you defined.

The question is where DO you define the settings for log on as a service in the group policy management console I have to work with.

In the left pane, right click the GPO you want to edit and select edit.   Drill down to Computer Configuration>Windows Settings>Security Settings>Local Polices>User Rights Assignment.  You find Log on as a service in the right pane.