Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

where on a Windows Server (2008R2 or before) can I find the permissions (allow/deny) who can actually start/stop services? Not to change the credentials which should be used by the service - just start/stop.

Brgds, Stef

share|improve this question
add comment

2 Answers

up vote 1 down vote accepted

I don't believe there is any good GUI to do this on the local system, but maybe something has been added since I last looked.

I know SetACL can be used to modify the access control list of a service. Here is an example from the documentation about how to grant the ability to start/stop the Windows Time service domain1\group1. SetACL is pretty easy to use.

SetACL.exe -on "\\server1\W32Time" -ot srv -actn ace
           -ace "n:domain1\group1;p:start_stop"

You can set the permissions with the built-in sc as well, but the syntax is far more cryptic. The the options are sc sdset and sc sdshow.

The other option is to set the permissions through a policy.

Also see this question: How to set Windows Services permissions from Powershell?

share|improve this answer
    
SetACL Studio, the graphical permissions management tool built upon SetACL, is only weeks away. Actually a beta might be available next week. SetACL Studio sets/lists permissions on services just like SetACL does. –  Helge Klein Jul 22 '11 at 9:44
    
SetACL seems to be great. However, I wonder, where is this permissions set natively. There should be a way to review the ACL for services with nativ Windows tools? –  Stef Jul 22 '11 at 10:19
1  
Service permissions can only be set from group policies or from tools like SetACL or the service configuration tool sc.exe. –  Helge Klein Jul 30 '11 at 22:09
add comment

You can natively set permissions on services by editing the SDDL strings using SC.exe. There are several articles online that go through the details. Although using that method works, it's very tedious, error-prone and can be different depending on the OS. I haven't used SetACL Studio, but it looks pretty comprehensive based on their site.

If need to delegate rights to services on multiple machines and could possibly have more complex scenarios, I would recommend using System Frontier. You can configure permissions centrally, that can apply to one or more servers automatically without having to touch each individual server. Everything is based on role based access control (RBAC). Full disclosure: I own the company that makes System Frontier.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.