5

It's there a way i can give the rights to a specific user, for restart a specific service on windows server 2008 ?

7

You can use the sc command to set permissions on a specific service.

The format is a little difficult to understand, but first you will need to find the user or group's SID to use the command (something like "S-1-5-21-....").

sc myserver sdset spooler D:(A;;RPWP;;;place-sid-here)

A couple notes on that command:

  • RP Allows service start
  • WP Allows service stop

Replace myserver with your server's name and spooler with the service you want to edit.

More information is available at the following locations:

http://technet.microsoft.com/en-us/library/cc742037(WS.10).aspx

http://msmvps.com/blogs/erikr/archive/2007/09/26/set-permissions-on-a-specific-service-windows.aspx

|improve this answer|||||
  • Additionally you need to prefix the entires with D: as per my answer here. In your example, this would be: sc myserver sdset spooler D:(A;;RPWP;;;place-sid-here) – Will Sep 24 '10 at 14:25
1

Waiting for my VMs to spin up, but it looks like this should work (from reading this)

  • Open group policy to Computer Configuration\Policies\Windows Settings\Security Settings\System Services
  • Edit the service in question, enable "define policy setting" and then "edit security"
  • Add the user and give them "read" and "start, stop, and pause" rights

I'll swing by after I've tried this out, but good question! I had no idea this had been added.

This might also work: Remotely restarting a service for a non-administrator user

|improve this answer|||||
  • When i go Configuration\Policies\Windows Settings\Security Settings there is no System Services :-( – Cédric Boivin Aug 3 '10 at 13:48
  • Hmm...maybe an R2/Win7 feature of Group Policy? Unfortunately, I don't have a way to test downlevel but mine matches @Kara. – Doug Luxem Aug 3 '10 at 13:58
  • That's very odd! You're on the domain controller, and it's 2008 server? – Kara Marfia Aug 3 '10 at 14:08
  • 1
    Ach, sounds like it's R2, bummer! – Kara Marfia Aug 3 '10 at 14:20
  • No i am not on the domain controller, i am on the server directly, because it's a custom service, install only on this machine. – Cédric Boivin Aug 3 '10 at 14:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.