Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is it possible to use Group Policy to grant the permission to manage Windows services?

I would really like to know if this is even possible, and if so, where do you recommend I look for more information? I'm particularly interested in Server 2003.

I've tried some pretty obvious web searches but most of the resuls for Group Policy, Windows Services, or Permissions (and similar combinations) end up discussing how to enable or disable specific services via GP, not allowing a user or a group to do those things manually.

I may be barking up the wrong tree with my approach. Any suggestions are greatly appreciated.

share|improve this question
    
Are you looking to permit them to start/stop/edit individual services, or just deny/gain access to the services control panel? –  Mark Henderson Aug 19 '09 at 7:32
    
I'm trying to allow a group of users (who are not admins) to use the full capability of sc.exe for managing services. Including starting stopping, creating, and deleting. –  Damian Powell Aug 19 '09 at 12:45
    
@Damian: You're looking to allow non-administrator users to create services, eh? That's a whole different ballgame. I'll drop on an edit. –  Evan Anderson Aug 19 '09 at 12:49
    
+1 for the question; I can see how this can be more generally useful if, for example, you have a custom app that runs a service and you want to let users control that without giving them full admin. –  Darth Satan Aug 19 '09 at 13:23

3 Answers 3

up vote 4 down vote accepted

You can definitely use Group Policy to grant users rights to start / stop services. You just need to modify the security descriptor on the service using the "Security" group policy client side extension.

A very slight caveat: I have seen cases where some services don't like the default permission that a group policy-based modification puts on a service (look at this posting about the Windows Search service if you want to see what I'm talking about: http://peeved.org/blog/2007/12/07), but that has been uncommon in my experience.

In order to "see" the service in the Group Policy editor you'll need to do the editing on a computer that has the service installed. (If this is a stock Windows service then it's no big deal, but if it's something third-party get on a machine that has it installed, "runas" a copy of MMC, and snap-in a Group Policy editor targeted at the GPO where you want to put these settings.)

Under "Computer Settings", "Windows Settings", "Security Settings", and "System Services", locate the service you want to grant start / stop permission to and define a policy setting. You have to choose a startup type. Click "Edit Security" and modify the default ACL to include the permissions you're looking for.

I'd recommend testing the GPO on a constrained group of computers (either by linking the GPO to a test OU with a single computer, or by filtering the GPO to only a single computer) and making sure it does what you want before you go changing the security on all your computers only to find out it doesn't do what you want.

Here's some background on what the various entries in an ACE mean for services:

To see the descriptors in SDDL notation, use the "sc sdshow service-name" command.

Edit:

Delegated permission to create new services is going to be a little bit tough. There is a "SC_MANAGER_CREATE_SERVICE" right that can be granted to users on the service control manager (SCM) object in the global object manager.

In Windows versions up to Windows Server 2003, the rights could not be changed on the SCM. Starting in W2K3 SP1, you could change the rights on the SCM.

The API to change the security is SetServiceObjectSecurity, and more information is available here: http://msdn.microsoft.com/en-us/library/aa379589%28VS.85%29.aspx

Some more reference re: the rights that can be granted to the SCM and the default DACL set on the SCM is available here: http://msdn.microsoft.com/en-us/library/ms685981%28VS.85%29.aspx

In short, there's no way to do this w/o writing code. There's no magic registry setting, etc. If you can get somebody to write the code for you, though, it's totally feasible.

share|improve this answer

Take a look at these knowledge base articles at Microsoft - How To Configure Group Policies to Set Security for System Services and How to grant users rights to manage services in Windows 2000 which discusses alternative methods of granting access to manage services.

Hope this helps.

share|improve this answer

The solution provided by Microsoft just covers Windows 2000 Systems, as they say at the bottom of the Article, even though the solution is valid for all of their OS.

How to Add Third-Party Services to the System Services in Group Policy

So it's a huge step back in its centralization idea for their Group Policy infrastructure released with Windows 2008 R2.

How to create the Central Store for Group Policy Administrative Template files in Windows Vista

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.