Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to configure my Windows 2008 servers so that my developers can view their status without needing to log on to the box or be an admin. Unfortunately, the permissions set in Windows 2008 for remote non-admin users don't include the ability to enumerate or otherwise query services. This causes anything that contacts the SCM on the far end to fail (Win32_Service, sc.exe, services.msc etc).

How do I set up permissions so that they can at least list the services and see if they are running?

share|improve this question
    
Hi -- did you resolve this? We're trying to do similar so we can do a remote WMI (e.g. wmic /node:server services list) to no avail. WMI perms are good as we can do remote WMI queries on other namespaces/classes without issue. –  Chris J Dec 13 '10 at 17:41
    
Hah -- sorted. See below :-) –  Chris J Dec 13 '10 at 19:36
add comment

4 Answers

After some googling around today, I found this MSDN article. It seems to work so far, even though the security descriptor is for Windows Server 2003. I've found you can do sc sdshow SCMANAGER to get the current value so when back in the office tomorrow I'll be comparing an contrasting to make sure I've not locked something out I shouldn't have :-)

share|improve this answer
add comment

A quick and dirty solution would be PSList running every minute via scheduled task and dumping to a text file available via IIS.

This might be applicable: How to grant users rights to manage services in Windows 2000.

share|improve this answer
add comment

Read this article about security descriptor definition language (SDDL) in relation to Windows services security. Hope you'll find a combination of access control parameters which satisfy all your needs.

share|improve this answer
add comment

You can enable non administrators to use the SCM or any other MMC snap-in by editing Group Policies. Maybe this Microsoft KB entry will help you.

...without needing to log on to the box or be an admin...

This won't be possible, because windows uses authorisation on nearly every interface, also connection through an MMC snap-in will require authorisation.

share|improve this answer
    
Access to the MMC itself is not the issue - I'm talking about remoteaccess to the SCM subsystem. –  user2278 Aug 3 '09 at 13:17
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.