Keeping administartor equivalent users from stopping services

[Harold Turpen]

Am installing an enterprise asset management, Help desk,
remote control, software distribution application
(www.Triactive.com). This application runs a service that
must remain active at all times. However, if a user with
Administrator priveledge stops the service, information of
the machine stops building and remote control will not
work. I would like to be able to take away the ability
from the user to stop a/or all services. Can this be done
without using AD?

 

[Jerold Schulman]

Am installing an enterprise asset management, Help desk,
remote control, software distribution application
(www.Triactive.com). This application runs a service that
must remain active at all times. However, if a user with
Administrator priveledge stops the service, information of
the machine stops building and remote control will not
work. I would like to be able to take away the ability
from the user to stop a/or all services. Can this be done
without using AD?

You can use local group policy, GPEDIT.msc
Remove the STOP permission.
See tip 4673 in the 'Tips & Tricks' at http://www.jsiinc.com for the path.


Jerold Schulman
Windows: General MVP
JSI, Inc.
http://www.jsiinc.com

 

[Torgeir Bakken \(MVP\)]

Am installing an enterprise asset management, Help desk,
remote control, software distribution application
(www.Triactive.com). This application runs a service that
must remain active at all times. However, if a user with
Administrator priveledge stops the service, information of
the machine stops building and remote control will not
work. I would like to be able to take away the ability
from the user to stop a/or all services. Can this be done
without using AD?

Hi

Relevant for WinXP/Win2k3 as well:

HOW TO: Grant Users Rights to Manage Services in Windows 2000
http://support.microsoft.com/?kbid=288129

It might work to deny access (instead of granting) using one of
the methods in the article above (but as a local administrator,
you can always add yourself back if you have the knowledge).


For method 3 in the article above:

A new, bug-fixed version of SubInACL.exe is available for download here
(Win2k/WinXP/Win2k3):

http://www.microsoft.com/downloads/details.aspx?FamilyID=e8ba3e56-d8fe-4a91-93cf-ed6985e3927b

SETACL (freeware) at http://setacl.sourceforge.net/ can also set permissions
on local or remote Win32 services.