Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a very basic domain that I use for development. I want to create a GPO that provides users in the Backup Operators group with start/stop permissions for two specific services on a specific server.

I have read several articles about this, and they all indicate that this is very easy. Create a GPO, give the user start/stop permissions to the services under Computer Configuration > Policies > Windows Settings > Security Settings > System Services, and voila. Done.

Not so much, but I have to be doing something wrong.

My install is pretty much the default. The domain controller is in the Domain Controllers OU, the Backup Operators group is under Builtin, and I created a user called Backup under Users.

I created a GPO and linked it to the Domain Controllers OU. In the GPO I give the Backup user permission to start/stop two specific services on the server. I forced an update with gpupdate. I used Group Policy Results to verify that my GPO is the winning GPO giving the user the permission to start/stop the two services.

However, the user is still unable to start/stop the services. I attempted different loopback settings on the GPO to no avail.

I'm sort of at a loss here.

share|improve this question
Is the service you are trying to give them permissions to manage on the domain controller or another server? –  longneck Jun 24 '13 at 20:33
On the domain controller. –  slakr007 Jun 24 '13 at 21:14
How is the specified user account managing the services? Is it logged on to the dc console/rdp session as the user? –  Greg Askew Jun 24 '13 at 21:20
I've tried running cmd as the user and logging in via RDP as the user. Ultimately, however, the point is to run a scheduled task as the user to stop the service, backup its data, and restart the service. In all cases, I just keep getting an access denied error. –  slakr007 Jun 24 '13 at 21:30
Let me rephrase that. I have only tried via RDP. I have logged in as Administrator to make all of the GPO changes, then tried controlling the services via cmd running as the Backup user. I have also tried logging in as the Backup user and then attempting to control the services. –  slakr007 Jun 24 '13 at 22:21
show 2 more comments

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.