up vote 1 down vote favorite
share [g+] share [fb]

where on a Windows Server (2008R2 or before) can I find the permissions (allow/deny) who can actually start/stop services? Not to change the credentials which should be used by the service - just start/stop.

Brgds, Stef

link|improve this question
40% accept rate
feedback

2 Answers

up vote 1 down vote accepted

I don't believe there is any good GUI to do this on the local system, but maybe something has been added since I last looked.

I know SetACL can be used to modify the access control list of a service. Here is an example from the documentation about how to grant the ability to start/stop the Windows Time service domain1\group1. SetACL is pretty easy to use.

SetACL.exe -on "\\server1\W32Time" -ot srv -actn ace
           -ace "n:domain1\group1;p:start_stop"

You can set the permissions with the built-in sc as well, but the syntax is far more cryptic. The the options are sc sdset and sc sdshow.

The other option is to set the permissions through a policy.

Also see this question: How to set Windows Services permissions from Powershell?

link|improve this answer
SetACL Studio, the graphical permissions management tool built upon SetACL, is only weeks away. Actually a beta might be available next week. SetACL Studio sets/lists permissions on services just like SetACL does. – Helge Klein Jul 22 '11 at 9:44
SetACL seems to be great. However, I wonder, where is this permissions set natively. There should be a way to review the ACL for services with nativ Windows tools? – Stef Jul 22 '11 at 10:19
1  
Service permissions can only be set from group policies or from tools like SetACL or the service configuration tool sc.exe. – Helge Klein Jul 30 '11 at 22:09
feedback
up vote -1 down vote

This should provide you the needed information - http://support.microsoft.com/kb/256299.

link|improve this answer
That link you provided wasn't very useful, did you intend to link to support.microsoft.com/kb/256345 instead? It is one of the articles that page refers to. – Zoredache Jul 22 '11 at 8:23
Exactly, the posted link describes the symptom (which is subjectively useful) and identifies the KB with the step-by-step as you have recapped. – user48838 Jul 22 '11 at 8:41
@user48838 - don't mod-alert just because your feelings are hurt, Zoredache is right, your link (which we don't like usually anyway) doesn't directly offer an answer. You can do better, we know. – Chopper3 Jul 22 '11 at 12:01
You're right. Most of the rude comments are from the folks with mod status. Its unfortunate and I am hardly the first person with the observation. Nice "professional" attitudes folk (you "folks" have your fair share of stuff which is "questionable" at best).. – user48838 Jul 22 '11 at 17:08
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.