Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to allow read-only mode so that someone to use management console to 'connect to another computer' and see the services running? This is a Win2008 server, and the users will not have any rights except to be able to see the windows services. Or is there a better way of achieving the same thing?

share|improve this question
up vote 2 down vote accepted

Each service has a ACL. This controls who can see the status, stop/start and configure. There is no inbuilt UI to give access to it, but sc.exe sdshow service" will show the ACL in [SDDL][1] form, thesdsetcommand forsc.exe` allows the ACL to be set.

Based on the default for one service I looked at ("Windows Search"), all interactive users can query this service, but for Windows Update the access is different and based on all users (i.e. remote as well as logged in locally).

Since the access rights flags are expanded symbolically, but generically it will be necessary to work out the underlying bit pattern to translate to service ACE flag names.

(There is an interactive services ACL editor when using Group Policy to enforce services configuration.)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.