locked
How to give a user permissions to start and stop services on Windows 2008

    Question

  •  I'm trying to give a domain user rights to start and stop services on Windows 2008 server but I don't want to give the user local admin rights.  I've used "subinacl" tool but no success.  I'm using "sc" command to execute the stop, start, and query command from a remote computer and I can do this if I give the user local admin rights on the server where the service resides.  No other built in group works other than the local admin group. 
    • Edited by jarmea Wednesday, February 04, 2009 6:21 PM
    Wednesday, February 04, 2009 2:23 PM

Answers

  • hi there,

    i would like to know why do you want to give domain users the permissions to start and stop the service.

    by default all the services are managed / symbolic link is provided in registry .Default which will have the control which user to start and stop the service.

    but as an enterprise architect i would not prefer you to fiddle around the service, unless they are custom service / service which you have written.
    sainath Windows Driver Development
    Wednesday, February 04, 2009 5:29 PM

All replies

  • hi there,

    i would like to know why do you want to give domain users the permissions to start and stop the service.

    by default all the services are managed / symbolic link is provided in registry .Default which will have the control which user to start and stop the service.

    but as an enterprise architect i would not prefer you to fiddle around the service, unless they are custom service / service which you have written.
    sainath Windows Driver Development
    Wednesday, February 04, 2009 5:29 PM
  •  thanks for your reply.

    This is a custom service which our company wrote.  When our testers hit a snag they need to ask a support team to restart the service for them.  I just want to give a user right to be able to restart that service from their machine without logging on to the server.  I don't want to give them local admin rights either.  The requirement is to be able to use this tool from their desktop:

    sc \\myservername stop "Custom Service"
    sc \\myservername start "Custom Service"
    sc \\myservername query "Custom Service"

    I tried granting rights using the following but it did not work:

    SubInAcl /service \\myservername\Custom Service /GRANT=Mydomain\Username=TOQ

    T : Start Service
    O: Stop Service
    Q: Query Service

    I also tried using Group Policy - Security Configuration and Analysis and gave rights to the user but that didn't work either.

    jarmea

    Wednesday, February 04, 2009 6:19 PM
  • We also need to know how to do this.  We want to avoid granting our users Admin-level permissions but need to allow them to stop/start specific services for the applications they install/support without changing the account used to run the service.  We've tried  Power Users which doesn't work.  Please explain how best to do this.  Thanks!
    Wednesday, July 15, 2009 6:58 PM
  • We also need to know how to do this.  Works great in Windows 2003 but not 2008. 
    Wednesday, August 12, 2009 11:01 PM