Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to give a non-administrator user the ability to restart a service on a server, but I'm getting "access denied" following these instructions:

I've created a user called "serviceuser" that's a member of the Domain Users group. I created a new OU called "SpecialAuthority" and this user is a member of that OU. I've created a group policy of the same name as the OU, granted that user (on the particular service I'm interested in) the rights of "Start, Stop, Pause". Logged into a machine as serviceuser to test sc from the command prompt as follows:

sc \\server stop SomeAppService

I did a gpupdate, no dice; waited a full day, no dice.

share|improve this question
up vote 1 down vote accepted

The instructions you linked to are for computer policies, not user policies so you need to apply them to the OU that the computer is in rather than the user. You should give permission to a security group to the service in this policy and then add the user to that security group.

share|improve this answer
And the computer would be the workstation that the user will be using? – gravyface Nov 24 '09 at 15:52
+1 for the right answer, but I'm going to have to try something else as this server is a domain controller (SBS 2003), and don't want to move it to a different OU. – gravyface Nov 24 '09 at 16:16
you can make a sub OU inside the domain controllers OU and it will inherit all the other policies from the parent OU – JamesRyan Nov 24 '09 at 16:31

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.