Letting a User Start and Stop Services Without Granting the User Administrator Privileges

Services have ACLs like other objects do, so you can grant services specific start and stop permissions. Unfortunately, the Microsoft Management Console (MMC) Services snap-in doesn't expose service ACLs in the interface, but two other methods for editing service permissions are available.

With the first method, you create a security template via the MMC Security Templates snap-in and navigate to the System Services folder. Open the Service Properties page, select the Define this property check box, and click Edit Security, which opens the ACL for the service. Grant the consultant Start, stop and pause permission. Save the policy, and apply it by using the MMC Configuration and Analysis snap-in.

The other method is more direct but it requires that you use the command line. Using the /service parameter with the Subinacl command lets you grant permissions to a service. For example, to grant Randy in domain Acme Start, stop and pause permission for the Spooler service, open a command line and type

subinacl /service spooler /grant=acme\randy=top

Note that you must specify the service name of the service, not its display name. You can get a list of all services with their display names and actual names by typing the command sc query

You can download Subinacl from http://go.microsoft.com/fwlink/?LinkId=23418. When you execute the subinacl.msi file, it installs the Subinacl command and a Help file in the %programfiles%\Windows Resource Kits\Tools folder.

Comments

Debasish said…
Can u explain me about generations in Garbage Collector.(with real time example)

Popular posts from this blog

Solved Account lockout issue

My Wintel Infrastructure Transitioning Experience

A Nice Lesson