Disabling Ability to Shutdown Service

[Guest]

We have a service that runs on our XP workstations that is set to startup
when the system is rebooted (Start Up Type set to automatic). We have an
issue with some users going in and stopping this service and also disabling
the startup. End result is the servcie isn't running.

Is there a way to disable the ability to both stop the service manually
(right click on service, Properties, Stop) and not allow them to change the
startup type to Disable?
Can the ability to do this be password protected?

Paul

 

[Malke]

We have a service that runs on our XP workstations that is set to startup
when the system is rebooted (Start Up Type set to automatic). We have an
issue with some users going in and stopping this service and also
disabling the startup. End result is the servcie isn't running.

Is there a way to disable the ability to both stop the service manually
(right click on service, Properties, Stop) and not allow them to change
the startup type to Disable?
Can the ability to do this be password protected?

You don't tell us if you have a domain and if so, what operating system is
on the server. You also don't tell us what version of XP you have (must be
Pro with a domain, but could be Home in a Workgroup).

Your users should not be administrators on workstations and they definitely
should not be able to run services.msc. You limit users with
permissions/rights, not with passwords.

Post back with a better description of the computers, the operating systems
running, and your network for focused help.

Malke

 

[Steven L Umbach]

I agree with Malke in that if the users are local administrators then that
is expected behavior. You can change permissions on services a few different
ways. For Active Directory domain computers you can use Group Policy
computer configuration/Windows settings/security settings/system services.
For all computers you can use the Windows command line tool subinacl or a
free third party tool such as setacl. If the users must be local
administrators it still may be worthwhile to put them in a global group [if
in a domain] and give that group deny permission to stop and write for the
service. Even many knowledgeable administrators don't know to change
permissions to services.

Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;288129
http://setacl.sourceforge.net/html/examples.html --- see example 23

SetACL.exe -on "\\server1\W32Time" -ot srv -actn ace
-ace "n:domain1\group1;p:start_stop"Sets permissions to start and
stop the Windows time service on server 'server1' for group 'group1' in
domain 'domain1'.