1

I need to be able to grant a user permissions to restart a single service on a Windows server without giving them administrative rights or rights to restart any other services.

I also need them to be able to install a single program via the CMD line but no other programs. I can give them admin access to the folder where the program will be installed but i need to somehow give them permissions to register the DLLs for the service without giving them admin access.

Is this possible?

Improve this question

2 Answers 2

Reset to default
3

Granting permissions to restart a service is easily possible with SetACL (example). You do not have to log on interactively to restart a service, you can simply use the services management console to connect remotely.

I am not entirely sure, but I think that for installing programs you need to be a member of the group "Administrators".

Improve this answer
4
  • This sounds good for the Services I will try it thanks If anyone has ideas for the installing that would be great. Can you give admin permissions for a command line script to run as an admin without knowing the admin password or the local user having admin access
    – cpgascho
    Feb 23, 2011 at 13:37
  • What is the difference between your tool SetACL & Subinacl.exe?
    – cpgascho
    Feb 23, 2011 at 17:03
  • Please post new questions in a new thread.
    – Helge Klein
    Feb 23, 2011 at 20:03
  • serverfault.com/questions/239390/setacl-vs-subinacl-exe
    – cpgascho
    Feb 23, 2011 at 20:09
0

While I am not a Windows admin, but rather a developer, this is my suggestion: try setting the "Log on as" to the users account in the Log On tab of the service properties. This works for me when I want access to a service without administrator privileges, or if I need a service to interact with my account.

Improve this answer
2
  • I'd advise against this in a production environment. When the user's password changes the service will not start and the user can potentially get locked out from too many failed login attempts.
    – squillman
    Feb 18, 2011 at 20:31
  • This may work except that the service already runs under a special account in order to make it work properly.
    – cpgascho
    Feb 18, 2011 at 20:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .