Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have a suite of Windows Services running on our servers which perform a bunch of automated tasks independently of one another, with the exception of one service which looks after the other services.

In the event that one of the services should fail to respond or hang, this service attempts to restart the service and, if an exception is thrown during the attempt, emails the support team instead, so that they can restart the service themselves.

Having done a little research, I've come across a few 'solutions' which range from the workaround mentioned in KB907460 to giving the account under which the service is running administrator rights.

I'm not comfortable with either of these methods - I don't understand the consequences of the first method as outlined in Microsoft's knowledge base article, but I definitely don't want to give administrator access to the account under which the service is running.

I've taken a quick look through the Local Security Policy and other than the policy which defines whether or not an account can log on as a service, I can't see anything else which looks like it refers to services.

We're running this on Server 2003 and Server 2008, so any ideas or pointers would be graciously received!


Clarification: I don't want to grant the ability to start/stop/restart ALL services to a given user or group - I want to be able to grant the permission to do so on specific services only, to a given user or group.


Further Clarification: The servers I need to grant these permissions on do not belong to a domain - they are two internet-facing servers which receive files, process them and send them on to third parties, as well as serving a couple of websites, so Active Directory Group Policy isn't possible. Sorry that I didn't make this clearer.

share|improve this question
1  
Sorry I missed you... I was busy. You were looking for something like this: serverfault.com/questions/15147/… –  Evan Anderson Oct 7 '10 at 1:54
    
I know this is a very old question, but did you consider using the 'recovery' options in the Windows service manager? –  Tim Long Apr 29 '13 at 9:08

4 Answers 4

up vote 29 down vote accepted

There doesn't appear to be a GUI-based way of doing this unless you're joined to a domain - at least not one I could find anywhere - so I did a bit more digging and I've found an answer that works for our sitaution.

I didn't understand what the string representation meant in the knowledge base article, but doing a bit of digging led me to discover that it's SDDL syntax. Further digging led me to this article by Alun Jones which explains how to get the security descriptor for a service and what each bit means.

To append to the service's existing security descriptor, use sc sdshow "Service Name" to get the existing descriptor. If this is a plain old .NET Windows Service - as is the case with ours - the security descriptor should look something like this:

D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOC
RRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;CR;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)S:(AU;FA
;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

We needed to grant permissions RP (to start the service), WP (to stop the service), DT (to pause/continue the service) and LO (to query te service's current status). This could be done by adding our service account to the Power Users group, but I only want to grant individual access to the account under which the maintenance service runs.

Using runas to open a command prompt under the service account, I ran whoami /all which gave me the SID of the service account, and then constructed the additional SDDL below:

(A;;RPWPDTLO;;;S-x-x-xx-xxxxxxxxxx-xxxxxxxxxx-xxxxxxxxx-xxxx)

This then gets added to the D: section of the SDDL string above:

D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOC
RRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;CR;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)(A;;RPWP
DTLO;;;S-x-x-xx-xxxxxxxxxx-xxxxxxxxxx-xxxxxxxxx-xxxx)S:(AU;FA;CCDCLCSWRPWPDTLOC
RSDRCWDWO;;;WD)

This is then applied to the service using the sc sdset command:

sc sdset "Service Name" D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;
CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;CR;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU
)(A;;RPWPDTLO;;;S-x-x-xx-xxxxxxxxxx-xxxxxxxxxx-xxxxxxxxx-xxxx)S:(AU;FA;CCDCLCSW
RPWPDTLOCRSDRCWDWO;;;WD)

If all goes according to plan, the service can then be started, stopped, paused and have it's status queried by the user defined by the SID above.

share|improve this answer
    
PS: Not sure you're supposed to answer your own questions - is this an acceptable way of doing things on ServerFault? –  abitgone Oct 5 '10 at 12:23
5  
Answering your own question is very much allowed and encouraged (particularly with a well researched answer such as yours). You can mark yourself as the answer as well. –  Ryan Bolger Oct 5 '10 at 15:25
6  
For an easier way of doing the same thing, you should look at using SetACL.exe. Here is an example of how to use it to set permissions on a service: SetACL.exe -on "\\server1\W32Time" -ot srv -actn ace -ace "n:domain1\group1;p:start_stop" –  Mason G. Zhwiti Aug 15 '11 at 23:39
2  
Our free GUI alternative may be easier to use... –  CoreTech Jan 3 '13 at 19:04
    
You could use Process Hacker (processhacker.sourceforge.net) for a GUI to configure all services. It includes hidden services and allows you to configure more settings of a service like the binary path - and the permissions. –  LonelyPixel May 4 '13 at 12:44

I just had the same problem.
You could use SubInACL.exe from the Resource Kit. Download the standalone utility here: http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=23510

Use msiexec /a PathToMSIFile /qb TARGETDIR=DirectoryToExtractTo to extract the files if you don't want to install the .msi

  1. Open a command prompt as Administrator
  2. Go to the directory where you placed the .exe
  3. Run subinacl /service SERVICE_NAME /grant=COMPUTER_NAME\USERNAME=TOP

T = Start service
O = Stop service
P = Pause/continue service

Full reference available here: http://www.sabin-bg.net/utilities/subinacl/subinacl.htm
Or type subinacl /help

Note: don't try subinacl /service SERVICE_NAME /perm as it could get you into trouble (lesson learned :P). The name could be misleading (perm != permission), as it deletes all permissions to all users (even Admin!).

share|improve this answer
    
Can't merge SO and SF accounts sorry Pat. –  Chopper3 Sep 21 '11 at 8:10
    
@Chopper3 Thanks for your response. In fact I have 2 SO accounts: one is registered and associated with this SF account; the other one is an unregistered SO account I had before registering (used the same email address). I was hoping the two could be merged so I can track the post I've done before. As mentioned here I tried to flag a post but couldn't do it on SO (1 reputation). This is why I flagged this post. I also tried to email team@stackoverflow.com more than two weeks ago but didn't get any response. Could you direct me to the right place/person please? –  patrx Sep 21 '11 at 23:12
    
Checkout the details of this procedure at MSDN: support.microsoft.com/?kbid=288129 –  Marc Climent Jun 5 '12 at 8:08

You're looking for Computer Configuration - Policies - Windows Settings - Security Settings - System Services

There you can not only define the service start type, but you can configure the security ACLs for each service as well. By default, the interface will only list the services that are installed on the machine you're running the GP Editor on.

To add services that only exist on another machine:

  • export the service's reg key from the other machine
  • import on the gpedit machine
  • apply the policy
  • delete the imported key
share|improve this answer
    
I trust you mean to do this through gpedit.msc, as the "Manage Server" window doesn't list a policies node. If so, I can't see an item underneath the Security Settings node which references "System Services" as you suggest above, on either Server 2008 or Server 2003. –  abitgone Oct 4 '10 at 16:13
    
Ah yes. I assumed you were planning on making these changes via group policy. –  Ryan Bolger Oct 4 '10 at 18:46
1  
Indeed - these are not member servers. Is there a way of targeting this using local policy, or some other method? –  abitgone Oct 5 '10 at 7:45

you might also take a look at this article from ms, which also points to GP modifications:

http://support.microsoft.com/kb/256345

share|improve this answer
    
Thanks tespen, but these particular servers don't belong to a domain, so I'd be unable to use Active Directory in this case. –  abitgone Oct 4 '10 at 16:20

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.