3

On a Windows Server (2008R2 or before), where can I find the permissions (allow/deny) who can actually start/stop services? Not to change the credentials which should be used by the service - just start/stop.

2 Answers 2

3

I don't believe there is any good GUI to do this on the local system, but maybe something has been added since I last looked.

I know SetACL can be used to modify the access control list of a service. Here is an example from the documentation about how to grant the ability to start/stop the Windows Time service domain1\group1. SetACL is pretty easy to use.

SetACL.exe -on "\\server1\W32Time" -ot srv -actn ace
           -ace "n:domain1\group1;p:start_stop"

You can set the permissions with the built-in sc as well, but the syntax is far more cryptic. The the options are sc sdset and sc sdshow.

The other option is to set the permissions through a policy.

Also see this question: How to set Windows Services permissions from Powershell?

4
  • SetACL Studio, the graphical permissions management tool built upon SetACL, is only weeks away. Actually a beta might be available next week. SetACL Studio sets/lists permissions on services just like SetACL does. Jul 22, 2011 at 9:44
  • SetACL seems to be great. However, I wonder, where is this permissions set natively. There should be a way to review the ACL for services with nativ Windows tools?
    – Stef
    Jul 22, 2011 at 10:19
  • 1
    Service permissions can only be set from group policies or from tools like SetACL or the service configuration tool sc.exe. Jul 30, 2011 at 22:09
  • I managed this via a domain group policy object. One thing to note, if the service is an installed piece of software, I had to install the GPMC Windows feature on the target server and create the policy on the server so it listed the correct services in 'Windows Settings > Security Settings > System Services' as my PC did not have the definition of these services.
    – Snellgrove
    Jul 24, 2015 at 10:43
1

You can natively set permissions on services by editing the SDDL strings using SC.exe. There are several articles online that go through the details. Although using that method works, it's very tedious, error-prone and can be different depending on the OS. I haven't used SetACL Studio, but it looks pretty comprehensive based on their site.

If need to delegate rights to services on multiple machines and could possibly have more complex scenarios, I would recommend using System Frontier. You can configure permissions centrally, that can apply to one or more servers automatically without having to touch each individual server. Everything is based on role based access control (RBAC). Full disclosure: I own the company that makes System Frontier.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .