There is a windows service that gets reinstalled sometimes.

I need a user to be able to start/stop/restart this service. This user is not an administrator and shouldn't be.

If I use setacl.exe than it works, or even I can use sc sdset, but after the service gets reinstalled setacl needs to be called again, but the process that reinstalls the service has no rights to run setacl.

Is there a way to grant a specific user the right to restart a service with a specific name, or even all services, that persists through a service reinstall?

If I'm able to give a user some general permissions to "manage services" that would also be fine, but I'm unable to pinpoint the exact rights needed for this (if I add the user to the admin group, he can start/stop services, but can -obviously- do a lot more than that).

2 Answers 2


Since you've already know about SetACL, and how to use it to allow a user to control a service, you could simply use Scheduled Tasks to regularly run SetACL.

Configure the task to repeat in an interval as small, as the longest acceptable time the user cannot control the service, after a re-installation.


As you say, it is kind of hacky ;).

Another option, as Adam mentions, is to use GPO's to enforce your ACL.

For a non-standard Windows services, you will have to install and run the Group Management Console, on the computer where the service is installed. Then do the following:

  1. Launch GPMC.msc on the computer
  2. Edit an existing GPO, or create a new, that applies to the computer in question
  3. Expand Policies, Windows Settings, Security Settings, System Services
  4. Open the properties of the service in question
  5. Define startup mode and edit permission as desired
  • Although this seems very hacky I like it. Mar 17, 2014 at 15:45

Permissions for restarting a service are fairly straightforward, and you can use Subinacl.exe /service to assign permissions, eg:

subinacl /service MyServiceName /GRANT=NTDOMAIN\BOB=STOPI
  • STOPI = query status
  • STOPI = start
  • STOPI = stop
  • STOPI = pause/continue
  • STOPI = interrogate.

Full list at support.microsoft.com.

The problem you're getting, I think, is that when MyServiceName is deleted, the ACLs are deleted along with it. You can get around this by using Group Policy, or Security Templates, to assign permissions on services which may or may not exist.

  • Thanks for the reference to SUBINACL. Didn't know about that command :)
    – abstrask
    Mar 18, 2014 at 9:45
  • This did the trick for me on Windows 10. I was able to download subinacl.exe from Microsoft here.
    – jdgregson
    Jun 11, 2018 at 0:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.