7

I'm trying to control services on one W2k8 machine from another; no domain just a workgroup. The user account I'm logged in as is an administrator on both machines.

I've tried both psservice and sc.exe. These work in a Windows Server 2003 environment but it looks like I need to an extra step or two due to the changed security model in 2008. Any ideas as to how grant permission to the Service Control Manager (psservice) or OpenService (sc)? I tried running the DOS window with "Run As Administrator" and it made no difference.

With psservice I get the following

D:\mydir>psservice \\REMOTESERVER -u "adminid" -p "adminpassword" start "Display Name of Service"

PsService v2.22 - Service information and configuration utility
Copyright (C) 2001-2008 Mark Russinovich
Sysinternals - www.sysinternals.com

Unable to access Service Control Manager on \\REMOTESERVER:
Access is denied.

In the remote server, I get the following message in the Security Log so I know I connect and login to the remote machine. I assume it then fails on a subsequent authorization step. The logoff message in the security log is just that ("An account was logged off."), so no extra info there.

Special privileges assigned to new logon.

Subject:
 Security ID:  REMOTESERVER\adminid
 Account Name:  adminid
 Account Domain:  REMOTESERVER
 Logon ID:  0xxxxxxxx

Privileges:  SeSecurityPrivilege
   SeBackupPrivilege
   SeRestorePrivilege
   SeTakeOwnershipPrivilege
   SeDebugPrivilege
   SeSystemEnvironmentPrivilege
   SeLoadDriverPrivilege
   SeImpersonatePrivilege

sc.exe is similar. The command syntax and error differs as below but I also see the same login message in the remote server's security log.

D:\mydir>sc \\REMOTESERVER start "Registry Name of Service"
[SC] StartService: OpenService FAILED 5:

Access is denied.

1 Answer 1

7

Try adding setting [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ Policies\system\LocalAccountTokenFilterPolicy] = 1 and rebooting.

This comes from items 30 and 31 in FAQ: Common PSTools Issues and Description of User Account Control and remote restrictions in Windows Vista and helps turn down some of the UAC restrictions related to Administrative access across the network.

4
  • Many thanks. That was a great help. I get further now. I've got the a different message "Error opening servicename. More data is available" but I'm pretty sure that that is a separate problem on the remote server unconnected to the psservice issue.
    – Teflon Mac
    Feb 9, 2010 at 9:51
  • Must I add it to my computer or server computer?
    – Jaanus
    Jul 5, 2012 at 12:01
  • You need to add this the computer you are trying to connect to which in this case would be the server.
    – Sim
    Jul 6, 2012 at 13:33
  • Any other solution, since colleague can connect there without that regedit?
    – Jaanus
    Aug 27, 2012 at 11:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .