Group policy define new services with install them in main server

Question

I have Active Directory with Windows Server 2003 64-bit. One of my users asked me if it is possible if he can start and stop Oracle and MYSQL services from start --> control panel --> services. From there he can control them to start manually or automatically, but right now he cannot because of user privileges.

Is it possible to add new services in Group policy without installing Oracle and MySQL on Windows Server 2003?

Answer 1

So just to make sure I understand you correctly:

• A user has a Windows machine on which Oracle and MySQL are installed.
• That user is not a local machine Administrator.
• You want that user to be able to stop and start the Oracle and MySQL services.

It sounds like you tried to change the service permissions in Group Policy, but did so from a computer that doesn't have Oracle or MySQL installed, which means that those services don't appear in the list of available services.

I can think of three options:

1. Install the Group Policy Management Console (gpmc.msc) on the computer that has Oracle & MySQL.

   • If you're on Windows XP/2003, download and install the Group Policy Management Console with Service Pack 1.

   • If you're using Windows Vista/7, download and install the Remote Server Administration Tools for Windows 7 with Service Pack 1 (SP1).

   • If you're using Windows 2008/2008R2, add the feature Group Policy Management feature directly from Server Manager.

   Once gpmc is installed, you can edit the GPO on the computer that has Oracle & MySQL and you will see their services listed.

2. Create a dummy service on the computer you're using to edit the GPO.

   1. Find the ServiceKeyName of the service you want to change. (This is the "short name" of the service.) If you only know the DisplayName ("long name") but not the ServiceKeyName ("short name"), you can find it on the machine that has it installed, eg:

      sc GetKeyName "MySQL Service"

   2. Create a fake service on the computer you're using to edit the GPO:

      sc createServiceKeyNamebinPath= C:\Windows\system32\notepad.exe

   3. Edit the GPO.

   4. When you're done, you can delete the fake service with:

      sc deleteServiceKeyName

3. Forget GPO altogether and set the permissions directly on the service.

   First, see what the existing permissions are:

   C:\Windows\system32>sc sdshow ServiceKeyName

   D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

   Yikes! Isn't SDDL scary? Anyhow, the idea here is to add the permission bits we need into that mess. For example, you could allow all Domain Users to start, stop, pause and read permissions by adding:

   (A;;RPWPDTRC;;;DU)

   Or for local Users ("builtin Users"):

   (A;;RPWPDTRC;;;BU)

   So the final command would look something like:

   sc sdset ServiceKeyName D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SO)(A;;RPWPDTRC;;;BU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

4. Okay, I lied, I thought of one more way while writing this. ;-) You could use subinacl.exe for a simpler way of doing option 3. I don't know whether it's compatible with anything newer than Windows XP/2003 though.

   1. Download and install SubInACL.

   2. Use a command like:

      subinacl /serviceServiceKeyName/grant=Users=TOP

      (TOP is the subinacl syntax for sTart/stOp/Pause/continue)

If I've misread your question, please let me know.