Hot to allow Normal Users Start/Stop system services (Performance Logs and Alerts)

[Jon Bakersfield]

So I've been through most every document out there about allowing users to
start/ stop services. However every one I've read is about a client box in
a domain where group policy is the solution.

The service in question (or at least the one I know of - it doesn't have
dependencies) is Performance Logs and Alerts.

I'm simply trying to allow a user to start/ stop services on a local
machine, but what I've found is that if I look at the local security policy
I cannot find anywhere to make this change. I've also looked in Security
Config and Analysis, Templates, etc. and found no answer.

Meanwhile RSOP.msc (resultant set of policies) which would display any
policies that were imposed on the system from other sources (eg. group
policy in a domain) shows that the policy folder is locked and none of the
policies set. Presumably because there is no remote policy enforced since
this is a standalone system.

The local computer policy snap-in does not display the system services
folder at all, so it appears that what I am looking for can ONLY be
accomplished via a domain environment.

NE1 found a way around this?

Thanks in advance!

 

[Pegasus \(MVP\)]

So I've been through most every document out there about allowing users to
start/ stop services. However every one I've read is about a client box
in
a domain where group policy is the solution.

The service in question (or at least the one I know of - it doesn't have
dependencies) is Performance Logs and Alerts.

I'm simply trying to allow a user to start/ stop services on a local
machine, but what I've found is that if I look at the local security
policy
I cannot find anywhere to make this change. I've also looked in Security
Config and Analysis, Templates, etc. and found no answer.

Meanwhile RSOP.msc (resultant set of policies) which would display any
policies that were imposed on the system from other sources (eg. group
policy in a domain) shows that the policy folder is locked and none of the
policies set. Presumably because there is no remote policy enforced since
this is a standalone system.

The local computer policy snap-in does not display the system services
folder at all, so it appears that what I am looking for can ONLY be
accomplished via a domain environment.

NE1 found a way around this?

Thanks in advance!

You can let a normal user do anything by working indirectly with
a semaphore file. Here is how it works.
1. Create the batch file c:\Windows\StartStop.bat
@echo off
if "%1"=="" goto Action
echo net %1 perfmon > c:\Windows\StartStopService.bat
set verb=started
if /i %1==stop set verb=stopped
echo The service will be %verb% within 5 minutes.
pause
goto :eof
:Action
if exist c:\Windows\StartStopService.bat (
call c:\Windows\StartStopService.bat
del c:\Windows\StartStopService.bat
2. Give the user two shortcuts on his desktop.
Target for shortcut 1: c:\windows\StartStop.bat start
Target for shortcut 2: c:\windows\StartStop.bat stop
3. Create a scheduled job under an admin account.
It should run once every 5 minutes and invoke
c:\windows\StartStop.bat (with no parameters).