security for system services

  • Thread starter Thread starter Simon Morris
  • Start date Start date
S

Simon Morris

I'm running Windows 2003 R2. I want to give a specific user permissions
to stop and start system services. I have the Group Policy Editor up in
the Microsoft Management Console, but when I look in
LocalComputerPolicy/ComputerConfiguration/WindowsSettings/SecuritySettings,
I don't see the SystemServices field I was expecting, just
AccountPolicies, LocalPolicies, PublicKeyPolicies,
SoftwareRestrictionPolicies, and IPSecurityPoliciesOnLocalComputer.

How should I give the user the appropriate permissions?

Thanks,

Simon Morris
 
Simon Morris wrote on 18/05/2006 10:17
I'm running Windows 2003 R2. I want to give a specific user permissions
to stop and start system services. I have the Group Policy Editor up in
the Microsoft Management Console, but when I look in
LocalComputerPolicy/ComputerConfiguration/WindowsSettings/SecuritySettings,
I don't see the SystemServices field I was expecting, just
AccountPolicies, LocalPolicies, PublicKeyPolicies,
SoftwareRestrictionPolicies, and IPSecurityPoliciesOnLocalComputer.

How should I give the user the appropriate permissions?
Click to expand...

I've worked out I need to use a security template. I've created one that
gives the user the correct permissions. I've imported it into
LocalComputerPolicy/ComputerConfiguration/WindowsSettings/SecuritySettings,
and this didn't give any errors. I've done a "gpupdate". But the user
still can't stop the service, and I don't know how to use the Group
Policy Editor to check that the import worked OK.

Any suggestions?
 
Simon Morris wrote on 18/05/2006 11:22
Simon Morris wrote on 18/05/2006 10:17

I've worked out I need to use a security template. I've created one that
gives the user the correct permissions. I've imported it into
LocalComputerPolicy/ComputerConfiguration/WindowsSettings/SecuritySettings,
and this didn't give any errors. I've done a "gpupdate". But the user
still can't stop the service, and I don't know how to use the Group
Policy Editor to check that the import worked OK.

Any suggestions?
Click to expand...

In fact, if I redefine the service's startup in the security template,
and then import it into the LocalComputerPolicy, the startup doesn't
change. So the import seems to be failing. I'm logged on as
Administrator when I try to import - what else might be going wrong?
 
Simon Morris wrote on 18/05/2006 14:26
Simon Morris wrote on 18/05/2006 11:22

In fact, if I redefine the service's startup in the security template,
and then import it into the LocalComputerPolicy, the startup doesn't
change. So the import seems to be failing. I'm logged on as
Administrator when I try to import - what else might be going wrong?
Click to expand...

OK. I needed to use Security Configuration and Analysis to import the
security template into a database, and then use that database to
configure the local computer. I think there should be a simpler way to
do this, but never mind.

S.
 
Simon Morris said:
Simon Morris wrote on 18/05/2006 14:26

OK. I needed to use Security Configuration and Analysis to import the
security template into a database, and then use that database to configure
the local computer. I think there should be a simpler way to do this, but
never mind.

S.
Click to expand...

NTRights from the resource kit
 
Back
Top