Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I need to be able to grant a user permissions to restart a single service on a Windows server without giving them administrative rights or rights to restart any other services.

I also need them to be able to install a single program via the CMD line but no other programs. I can give them admin access to the folder where the program will be installed but i need to somehow give them permissions to register the DLLs for the service without giving them admin access.

Is this possible?

share|improve this question

2 Answers 2

Granting permissions to restart a service is easily possible with SetACL (example). You do not have to log on interactively to restart a service, you can simply use the services management console to connect remotely.

I am not entirely sure, but I think that for installing programs you need to be a member of the group "Administrators".

share|improve this answer
    
This sounds good for the Services I will try it thanks If anyone has ideas for the installing that would be great. Can you give admin permissions for a command line script to run as an admin without knowing the admin password or the local user having admin access –  cpgascho Feb 23 '11 at 13:37
    
What is the difference between your tool SetACL & Subinacl.exe? –  cpgascho Feb 23 '11 at 17:03
    
Please post new questions in a new thread. –  Helge Klein Feb 23 '11 at 20:03
    

While I am not a Windows admin, but rather a developer, this is my suggestion: try setting the "Log on as" to the users account in the Log On tab of the service properties. This works for me when I want access to a service without administrator privileges, or if I need a service to interact with my account.

share|improve this answer
    
I'd advise against this in a production environment. When the user's password changes the service will not start and the user can potentially get locked out from too many failed login attempts. –  squillman Feb 18 '11 at 20:31
    
This may work except that the service already runs under a special account in order to make it work properly. –  cpgascho Feb 18 '11 at 20:32

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.