Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On a Windows Server (2008R2 or before), where can I find the permissions (allow/deny) who can actually start/stop services? Not to change the credentials which should be used by the service - just start/stop.

share|improve this question
up vote 3 down vote accepted

I don't believe there is any good GUI to do this on the local system, but maybe something has been added since I last looked.

I know SetACL can be used to modify the access control list of a service. Here is an example from the documentation about how to grant the ability to start/stop the Windows Time service domain1\group1. SetACL is pretty easy to use.

SetACL.exe -on "\\server1\W32Time" -ot srv -actn ace
           -ace "n:domain1\group1;p:start_stop"

You can set the permissions with the built-in sc as well, but the syntax is far more cryptic. The the options are sc sdset and sc sdshow.

The other option is to set the permissions through a policy.

Also see this question: How to set Windows Services permissions from Powershell?

share|improve this answer
SetACL Studio, the graphical permissions management tool built upon SetACL, is only weeks away. Actually a beta might be available next week. SetACL Studio sets/lists permissions on services just like SetACL does. – Helge Klein Jul 22 '11 at 9:44
SetACL seems to be great. However, I wonder, where is this permissions set natively. There should be a way to review the ACL for services with nativ Windows tools? – Stef Jul 22 '11 at 10:19
Service permissions can only be set from group policies or from tools like SetACL or the service configuration tool sc.exe. – Helge Klein Jul 30 '11 at 22:09
I managed this via a domain group policy object. One thing to note, if the service is an installed piece of software, I had to install the GPMC Windows feature on the target server and create the policy on the server so it listed the correct services in 'Windows Settings > Security Settings > System Services' as my PC did not have the definition of these services. – Snellgrove Jul 24 '15 at 10:43

You can natively set permissions on services by editing the SDDL strings using SC.exe. There are several articles online that go through the details. Although using that method works, it's very tedious, error-prone and can be different depending on the OS. I haven't used SetACL Studio, but it looks pretty comprehensive based on their site.

If need to delegate rights to services on multiple machines and could possibly have more complex scenarios, I would recommend using System Frontier. You can configure permissions centrally, that can apply to one or more servers automatically without having to touch each individual server. Everything is based on role based access control (RBAC). Full disclosure: I own the company that makes System Frontier.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.