I have a very basic domain that I use for development. I want to create a GPO that provides users in the Backup Operators group with start/stop permissions for two specific services on a specific server.

I have read several articles about this, and they all indicate that this is very easy. Create a GPO, give the user start/stop permissions to the services under Computer Configuration > Policies > Windows Settings > Security Settings > System Services, and voila. Done.

Not so much, but I have to be doing something wrong.

My install is pretty much the default. The domain controller is in the Domain Controllers OU, the Backup Operators group is under Builtin, and I created a user called Backup under Users.

I created a GPO and linked it to the Domain Controllers OU. In the GPO I give the Backup user permission to start/stop two specific services on the server. I forced an update with gpupdate. I used Group Policy Results to verify that my GPO is the winning GPO giving the user the permission to start/stop the two services.

However, the user is still unable to start/stop the services. I attempted different loopback settings on the GPO to no avail.

I'm sort of at a loss here.

  • Is the service you are trying to give them permissions to manage on the domain controller or another server? – longneck Jun 24 '13 at 20:33
  • On the domain controller. – slakr007 Jun 24 '13 at 21:14
  • How is the specified user account managing the services? Is it logged on to the dc console/rdp session as the user? – Greg Askew Jun 24 '13 at 21:20
  • I've tried running cmd as the user and logging in via RDP as the user. Ultimately, however, the point is to run a scheduled task as the user to stop the service, backup its data, and restart the service. In all cases, I just keep getting an access denied error. – slakr007 Jun 24 '13 at 21:30
  • Let me rephrase that. I have only tried via RDP. I have logged in as Administrator to make all of the GPO changes, then tried controlling the services via cmd running as the Backup user. I have also tried logging in as the Backup user and then attempting to control the services. – slakr007 Jun 24 '13 at 22:21

For posterity... I have no idea what I was doing wrong before, but I revisited this and was able to get it to work twice (a second time just to make sure I wasn't crazy) using the exact process I described above with a group policy object.

The only thing I can think of that I might have done differently was giving the Backup user Read privileges as well as Start/Stop/Restart privileges on the services.

Thanks to those who helped.


Remote logins require administrator privileges to do any administration on a DC. GPOs won't help. And there are no user groups on a domain controller.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.