What built in group will allow users to restart services on a serv

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

We have a help desk that from time to time needs access to restart services
on a couple of our servers. I want to give them this permission to do this
via a custom mmc that will help them do this. I don't want to give them too
many permissions. Could the local "power users" do this? The only other
group is the domain "server operators" which is domain wide which may be too
much permission.

Thanks,

Mike B.
 
Server Operators is not actually domain-wide, but rather is
in use on all DCs of the domain.
Power Users is an over-allotment of privilege, which you
right have said you want to avoid.
You can set individual premission on services, one by one,
to allow some new custom group to have the abilities with
the services only. The trouble is that you need to do this
for each service. This may be workable if there are only
a few services that are problematic for which you want to
delegate this right. There are a couple ways to do this, but
you may find NTrights the most direct if you do not have a
large farms of servers needing this change. If you do have to
apply this widely look into using a GPO that affects those
servers and very carefully use it to set the permissions on
the services involved. Search the KBs first as there are some
thing you definitely want to know about if you are going to
use the GPO based method.
 
Okay, I am looking within the services mmc and I cannot find a tab for
security.
Is ther another place to add permissions for them. I have about 4 services
that may need to be restarted so setting them will not be a problem.

Thanks,

Mike B.
 
It is not available within services.msc
You need to either use a utility like NTrights from the reskit, or
use a sce template.
 
Mike said:
Okay, I am looking within the services mmc and I cannot find a tab for
security.
Is ther another place to add permissions for them. I have about 4 services
that may need to be restarted so setting them will not be a problem.
Click to expand...
Hi,

Relevant for Windows XP/Win2k3 Server also:

HOW TO: Grant Users Rights to Manage Services in Windows 2000
http://support.microsoft.com/?kbid=288129


For method 3 in the article above:

A new, bug-fixed version of SubInACL.exe is available for download here
(Win2k/WinXP/Win2k3):

http://www.microsoft.com/downloads/details.aspx?FamilyID=e8ba3e56-d8fe-4a91-93cf-ed6985e3927b

SETACL (freeware) at http://setacl.sourceforge.net/ can also set permissions
on local or remote Win32 services.
 
Back
Top