how to allow a user to restart a server service

[djc]

I want to know if it is possible to do the following (and if so how?):

I am going away on vacation and I am the only one that can restart a certian
service that has a chronic problem of jamming up. Restarting it always fixes
it. This is what I have had to do until I can spend the appropriate time
getting to the root of the problem. Well, I need to allow someone else to be
able to restart this service while I'm gone. Making this person an
administrator is not an option. What can I do? I would like to give the
minimum amount of permission/privelege neccessary to allow a user to restart
a server service. Preferably from his own machine so I do not have to grant
him the 'log on locally' right on the server.

any input is greatly appreciated. Thanks.

 

[Dave]

you are going away and leaving the company without a qualified admin to take
care of a known problem! shame on you! either fix it before you leave or
get someone who is qualified and trusted to stand in while you are gone.
maybe its time to hire a temp for your vacation time to sit there and watch
the server if its that important and prone to failure and you can't trust
fellow employees.

 

[Torgeir Bakken \(MVP\)]

I want to know if it is possible to do the following (and if so how?):

I am going away on vacation and I am the only one that can restart a certian
service that has a chronic problem of jamming up. Restarting it always fixes
it. This is what I have had to do until I can spend the appropriate time
getting to the root of the problem. Well, I need to allow someone else to be
able to restart this service while I'm gone. Making this person an
administrator is not an option. What can I do? I would like to give the
minimum amount of permission/privelege neccessary to allow a user to restart
a server service. Preferably from his own machine so I do not have to grant
him the 'log on locally' right on the server.

Hi

Relevant for WinXP/Win2k3 as well:

HOW TO: Grant Users Rights to Manage Services in Windows 2000
http://support.microsoft.com/?kbid=288129

For method 3 in the article above:

A new, bug-fixed version of SubInACL.exe is available for download here
(Win2k/WinXP/Win2k3):

http://www.microsoft.com/downloads/details.aspx?FamilyID=e8ba3e56-d8fe-4a91-93cf-ed6985e3927b

SETACL (freeware) at http://setacl.sourceforge.net/ can also set permissions
on local or remote Win32 services.



To administer the service remotely, you can use SC.exe for this:


For WinXP and Win2k3 Server, SC.exe is built in. Look up SC.exe in the
computer's "Help and Support Center".


For Win2k:

Many of the ResKit utilities, including SC.EXE are available free at:

ftp://ftp.microsoft.com/reskit/win2000/

and

http://www.microsoft.com/windows2000/techinfo/reskit/tools/default.asp

More about SC here:
Sc.exe: Service Controller Tool
http://www.tburke.net/info/reskittools/topics/sc.htm

 

[djc]

Not all companies have the resources to have an IT 'team'. I am the team,
the whole team. There are higher priorities than this service which keep me
from fixing it. Plus, I was expecting someone a little more security
conscious than you obviously are responding to my post. Hiring a 'temp' and
giving them complete administrative control on the network does NOT sound
like a good idea to me. If I had a trusted person then thats a different
story. Please stop wasting my time.

there is a valid security question here that I still need an answer too.
anyone have a serious answer?

 

[djc]

Thank you Torgeir. I will check this out immediately. I was replying to the
rude reply I got from 'Dave' and didn't see your reply yet. Thanks again. I
see you don't only live in the scripting groups. Good. You have been a great
help to me in the scripting groups as well!

thanks.