Microsoft KB Archive/288129

= How to grant users rights to manage services in Windows 2000 =

Article ID: 288129

Article Last Modified on 10/31/2006

-

APPLIES TO


 * Microsoft Windows 2000 Service Pack 1
 * Microsoft Windows 2000 Advanced Server
 * Microsoft Windows 2000 Service Pack 1

-



This article was previously published under Q288129





IN THIS TASK

 * SUMMARY
 * Method 1: Grant rights using Group Policy
 * Method 2: Grant rights using Security templates
 * Method 3: Grant rights using Subinacl.exe
 * REFERENCES



SUMMARY
This article describes several methods for granting users the rights to manage services in Windows 2000. By default in Windows 2000, only Administrators and Power Users can start, stop, or pause services. This article describes techniques for granting these rights to other users and groups.

back to the top

Method 1: Grant rights using Group Policy
It is possible to give these rights to users by applying Group Policy. For additional information about how to do this, click the following article number to view the article in the Microsoft Knowledge Base:

256345 Configuring Group Policies to set security for system services

The article gives detailed step-by step instructions. However, the article does not explicitly state that there are no corresponding settings in Local Group Policy.

back to the top

Method 2: Grant rights using Security templates
This method is very similar to Method 1, but it uses Security templates to change the permissions on system services. To do this, follow these steps:  Click Start, click Run, and then type MMC . On the Console menu, click Add/Remove Snap-in. Click Add. Select the Security Configuration and Analysis snap-in, and then click Add. Click Close, and then click OK. In the MMC, right-click the Security Configuration and Analysis item, and then click Open Database.</li> Give a name for the database, and then browse to where you would like to store it.</li> When prompted, select a Security Template to import. For example, the &quot;basicwk.inf&quot; contains values for the standard settings found on a Windows 2000 Professional computer.</li> In the MMC, right-click the Security Configuration and Analysis item, and then click the Analyze Computer now option. Choose a location for the log file, when prompted.</li> After analysis is complete, configure the service permissions as follows: <ol style="list-style-type: lower-alpha;"> Double-click the System Services branch in the MMC.</li> Right-click the service that you want to change, and then click Security.</li> Click Edit Security.</li> Add user accounts as required, and configure the permissions for each account. By default, the user will be granted &quot;Start, stop and pause&quot; permissions.</li></ol> </li> To apply the new settings to the local computer, simply right-click the Security Configuration and Analysis item, and then click the Configure Computer Now option.</li></ol>

It is also possible to export your modified settings from the MMC and apply these to multiple machines using the SECEDIT command-line tool that ships with Windows 2000. For more information on using SECEDIT type the following at the command prompt:

secedit /?

NOTE: Applying the settings in this way will re-apply all of the settings in the template and so may override other file, registry, or service permissions set by other means.

back to the top

Method 3: Grant rights using Subinacl.exe
The final method for assigning rights to manage services is to use the Subinacl.exe utility from the Windows 2000 Resource Kit. The syntax for this is:

SUBINACL /SERVICE \\MachineName\ServiceName /GRANT=[DomainName\]UserName[=Access]

Automating Multiple Changes
With Subinacl there is no option you can specify that will set the required access for all services on a given computer. However, the following sample script demonstrates one way the above method could be extended to automate the task: <pre class="fixed_text">  strDomain   = Wscript.Arguments.Item(0)'domain where computer account is held strComputer = Wscript.Arguments.Item(1)'computer netbios name strSecPrinc = Wscript.Arguments.Item(2)'user's login name as in: DomainName\UserName strAccess  = Wscript.Arguments.Item(3)'access granted, as per the list in the KB   'bind to the specified computer set objTarget = GetObject(&quot;WinNT://&quot; & strDomain & &quot;/&quot; & strComputer & &quot;,computer&quot;)

'create a shell object. Needed to call subinacl later set objCMD = CreateObject(&quot;Wscript.Shell&quot;)

'retrieve a list of services objTarget.filter = Array(&quot;Service&quot;)

For each Service in objTarget 'call subinacl to se the permissions command = &quot;subinacl /service &quot; & Service.name & &quot; /grant=&quot; & strSecPrinc & &quot;=&quot; & strAccess objCMD.Run command, 0

'report the services that have been changed Wscript.Echo &quot;User rights changed for &quot; & Service.name & &quot; service&quot; next