I need to give a non-administrator user the ability to restart a service on a server, but I'm getting "access denied" following these instructions: http://support.microsoft.com/kb/324802/EN-US/

I've created a user called "serviceuser" that's a member of the Domain Users group. I created a new OU called "SpecialAuthority" and this user is a member of that OU. I've created a group policy of the same name as the OU, granted that user (on the particular service I'm interested in) the rights of "Start, Stop, Pause". Logged into a machine as serviceuser to test sc from the command prompt as follows:

sc \\server stop SomeAppService

I did a gpupdate, no dice; waited a full day, no dice.


The instructions you linked to are for computer policies, not user policies so you need to apply them to the OU that the computer is in rather than the user. You should give permission to a security group to the service in this policy and then add the user to that security group.

  • And the computer would be the workstation that the user will be using? – gravyface Nov 24 '09 at 15:52
  • +1 for the right answer, but I'm going to have to try something else as this server is a domain controller (SBS 2003), and don't want to move it to a different OU. – gravyface Nov 24 '09 at 16:16
  • you can make a sub OU inside the domain controllers OU and it will inherit all the other policies from the parent OU – JamesRyan Nov 24 '09 at 16:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.