0

Is it possible to configure a service to run as a group and add users to that group on Windows XP?

I need the service to have the permissions of the users in that group so that they can logonn, authenticate and access their files. It is something along the lines of Linux where a user can use a service it that services is running as a group the user belongs to.

Windows allows a service to run a user, but I need to be a group. Does builtin security principals have a way to have users added to it.

2 Answers 2

2

You can't run a service as a group - it must be a user account.

Having said that, giving your requirements, it would seem that you could create a service user account and make that account a member of the group. This would allow the service to run with the same security contex as any other member of the group.

3
  • Does this means that the group acquires the permissions of the users added to it, ie their combined permissions, or does logging as the user give the permissions by combining the user's permissions with the group's permissions?
    – vfclists
    Apr 30, 2011 at 8:56
  • No, you actually have it backwards, the group does not get the combined permissions of all users. Instead the Users get the combinded permisions of all groups they are a member of. Think of of it like this -- you assign certain permissions to the group object, such as permissions on a specfic folder. You do this INSTEAD of giving specific users permissions on this folder. Then you add users to the group. Now any user that is a member of the group has the groups permissions and thus the permissions on the folder that you gave the group. Permissions should typically always be assigned to groups Apr 30, 2011 at 18:22
  • <continued> and not to users. Then users should be assigned into a group. This makes understanding who has excatly what permissions much more manageable. When you add new users it's easy to make sure they have the necessary permissions to do there job because you can assign them to the proper groups according to their job functions. They can later be removed from groups just as easy if their job role changes. Apr 30, 2011 at 18:24
4

No a service can not be set to run as a group. It has to be set to run as a user. You can set the service to interact with the logged on session, which should cause the service to run under the users credentials. I believe this requires some special handling within the service.

If you need something which always runs under the context of the logged on user, then I'd recommend making it an app which runs hidden, and adding it to the startup group for all users. This way it starts and stops when users log in and out.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .