Starting a service without admin priveledges

[Pete]

Hello,

I would like to enable a domain user without admin rights
to be able to start/stop a single service. I have tried
setting the user's account as the "log on" account for
the service. I have tried giving the user account "Read
and Execute" rights on the service executable; I have
given the specific user "log on as a batch job" and "log
on as a service" in Local Security Policy, and access is
denied.

I realize each of these shouldn't allow it to work, was
just trying some things out. Other than adding the user
to the Power Users or Admin group, is there another
specific area I can adjust security for this to work?

Thanks

 

[Torgeir Bakken (MVP)]

I would like to enable a domain user without admin rights
to be able to start/stop a single service. I have tried
setting the user's account as the "log on" account for
the service. I have tried giving the user account "Read
and Execute" rights on the service executable; I have
given the specific user "log on as a batch job" and "log
on as a service" in Local Security Policy, and access is
denied.

I realize each of these shouldn't allow it to work, was
just trying some things out. Other than adding the user
to the Power Users or Admin group, is there another
specific area I can adjust security for this to work?

Hi

Relevant for WinXP/Win2k3 as well:

HOW TO: Grant Users Rights to Manage Services in Windows 2000
http://support.microsoft.com/?kbid=288129

For method 3 in the article above:

A new, bug-fixed version of SubInACL.exe is available for download here
(Win2k/WinXP/Win2k3):

http://www.microsoft.com/downloads/details.aspx?FamilyID=e8ba3e56-d8fe-4a91-93cf-ed6985e3927b

SETACL (freeware) at http://setacl.sourceforge.net/ can also set permissions
on local or remote Win32 services.