10

We have a PowerShell script that restarts a service on another computer. When we use PowerShell's built-in service control cmdlets, like so:

$svc = Get-Service -Name MyService -ComputerName myservicehostname
Stop-Service -InputObject $svc
Start-Service -InputObject $svc

We get this error back:

Stop-Service : Cannot open MyService service on computer 'myservicehostname'.

However, when we use sc.exe, like so:

C:\Windows\System32\sc \\myservicehostname stop MyService
C:\Windows\System32\sc \\myservicehostname start MyService

the start and stop succeed.

The user doing the restarting is not an administrator. We use subinacl to grant the user permissions to start/stop and query the service:

subinacl.exe /service MyService /GRANT=MyServiceControlUser=STO

How come PowerShell can't stop my service but sc.exe can?

2 Answers 2

20

It turns out I wasn't giving enough permissions with subinacl. The possible access values for the grant action are:

    F : Full Control  
    R : Generic Read  
    W : Generic Write  
    X : Generic eXecute  
  or any following values  
    L : Read controL  
    Q : Query Service Configuration  
    S : Query Service Status  
    E : Enumerate Dependent Services  
    C : Service Change Configuration  
    T : Start Service  
    O : Stop Service  
    P : Pause/Continue Service  
    I : Interrogate Service  
    U : Service User-Defined Control Commands  

I was using S (Query Service Status), T (Start Service), and O (Stop Service). I also needed E (Enumerate Dependent Services). It appears that the PowerShell cmdlets need to look at dependent services when starting/stopping.

Here's my updated subinacl command:

subinacl.exe /service MyService /GRANT=MyServiceControlUser=STOE

If you don't want to download/use subinacl.exe, you can use PowerShell via the Carbon module's Grant-ServiceControlPermission or Grant-ServicePermission functions. (DISCLAIMER: I am the owner/maintainer of the Carbon project.)

3
  • Please mark this as your correct answer. This was a huge help for me for the exact same issue :) Oct 2, 2012 at 13:10
  • I've never heard of subinacl before. What a useful utility! Thank you for coming back to leave this information for the rest of us.
    – Dan
    Aug 17, 2015 at 18:34
  • Works great in non-domain environment with Windows 2016 servers to control services on remote computers. May 3, 2018 at 18:06
0

The following command works as expected on my Windows Server 2008 R2 machine.

Start-Service -InputObject $(Get-Service -Computer [ComputerName] -Name spooler)  

Can you also try this one-off command to determine if that works, annd have you verified that the user is a member of a group that is a member of the Users group on the target servers?

1
  • Your snipped doesn't work for me. Due to security requirements, I can't make the user a member of the Users group (or any built-in Windows group). Feb 7, 2012 at 19:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .