Which rights does a user need to control an windows service?

[Guest]

Hi,

I want to give a user the right(s) to control an already installed windows
service. The user runs an application which start a specific windows service
at application startup and stops the windows service when it does close /
exit.

Back in Windows XP this was working but it looks like, that non-admin users
can't control windows services anymore.

Does somebody know how or which rights a user needs to start & stop a
windows service? The windows service is already installed.

Thanks,
Olcay

 

[Dave R.]

Hi,

I want to give a user the right(s) to control an already installed
windows
service. The user runs an application which start a specific windows
service
at application startup and stops the windows service when it does
close /
exit.

Back in Windows XP this was working but it looks like, that non-admin
users
can't control windows services anymore.

Does somebody know how or which rights a user needs to start & stop a
windows service? The windows service is already installed.

I don't know about giving a user the rights to start and stop services
in general, that seems like too much of a security problem to me. I've
normally just changed the specific service's security descriptor to
allow a user or group of users to start and stop it. You can use the sc
command as an administrator to do this. Here's what I use, which gives
start/stop/query permissions for servicename to Authenticated Users:

sc sdset servicename
"D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;LCRPWP;;;AU)(A;;CCLCSWLOCRRC;;;IU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)SAU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"

Regards,

Dave

 

[Dave R.]

I don't know about giving a user the rights to start and stop services
in general, that seems like too much of a security problem to me.
I've normally just changed the specific service's security descriptor
to allow a user or group of users to start and stop it. You can use
the sc command as an administrator to do this. Here's what I use,
which gives start/stop/query permissions for servicename to
Authenticated Users:

sc sdset servicename
"D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;LCRPWP;;;AU)(A;;CCLCSWLOCRRC;;;IU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)SAU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"

BTW, that should have been all one line, I forgot it would get broken
up.

Regards,

Dave