Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is it possible to configure a service to run as a group and add users to that group on Windows XP?

I need the service to have the permissions of the users in that group so that they can logonn, authenticate and access their files. It is something along the lines of Linux where a user can use a service it that services is running as a group the user belongs to.

Windows allows a service to run a user, but I need to be a group. Does builtin security principals have a way to have users added to it.

share|improve this question
add comment

2 Answers 2

up vote 2 down vote accepted

You can't run a service as a group - it must be a user account.

Having said that, giving your requirements, it would seem that you could create a service user account and make that account a member of the group. This would allow the service to run with the same security contex as any other member of the group.

share|improve this answer
    
Does this means that the group acquires the permissions of the users added to it, ie their combined permissions, or does logging as the user give the permissions by combining the user's permissions with the group's permissions? –  vfclists Apr 30 '11 at 8:56
    
No, you actually have it backwards, the group does not get the combined permissions of all users. Instead the Users get the combinded permisions of all groups they are a member of. Think of of it like this -- you assign certain permissions to the group object, such as permissions on a specfic folder. You do this INSTEAD of giving specific users permissions on this folder. Then you add users to the group. Now any user that is a member of the group has the groups permissions and thus the permissions on the folder that you gave the group. Permissions should typically always be assigned to groups –  Richard West Apr 30 '11 at 18:22
    
<continued> and not to users. Then users should be assigned into a group. This makes understanding who has excatly what permissions much more manageable. When you add new users it's easy to make sure they have the necessary permissions to do there job because you can assign them to the proper groups according to their job functions. They can later be removed from groups just as easy if their job role changes. –  Richard West Apr 30 '11 at 18:24
add comment

No a service can not be set to run as a group. It has to be set to run as a user. You can set the service to interact with the logged on session, which should cause the service to run under the users credentials. I believe this requires some special handling within the service.

If you need something which always runs under the context of the logged on user, then I'd recommend making it an app which runs hidden, and adding it to the startup group for all users. This way it starts and stops when users log in and out.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.