How to give rights to one user for the restart of a service

Question

It's there a way i can give the rights to a specific user, for restart a specific service on windows server 2008 ?

Pretty much the same thing: http://serverfault.com/questions/15147/how-do-i-give-a-domain-user-permission-to-start-and-stop-a-tomcat-service — Evan Anderson, Aug 03 '10 at 14:14
Possible duplicate of [How do I give a domain user permission to start and stop a Tomcat service?](https://serverfault.com/questions/15147/how-do-i-give-a-domain-user-permission-to-start-and-stop-a-tomcat-service) — Vadzim, Sep 24 '18 at 10:30

Doug Luxem · Accepted Answer · 2011-02-14T14:34:14.043

7

You can use the sc command to set permissions on a specific service.

The format is a little difficult to understand, but first you will need to find the user or group's SID to use the command (something like "S-1-5-21-....").

sc myserver sdset spooler D:(A;;RPWP;;;place-sid-here)

A couple notes on that command:

RP Allows service start
WP Allows service stop

Replace myserver with your server's name and spooler with the service you want to edit.

More information is available at the following locations:

http://technet.microsoft.com/en-us/library/cc742037(WS.10).aspx

http://msmvps.com/blogs/erikr/archive/2007/09/26/set-permissions-on-a-specific-service-windows.aspx

edited Feb 14 '11 at 14:34

answered Aug 03 '10 at 13:46

Doug Luxem

9,592
7
49
80

Additionally you need to prefix the entires with D: [as per my answer here](http://serverfault.com/questions/184279/give-users-the-right-to-restart-a-service/184338#184338). In your example, this would be: sc myserver sdset spooler D:(A;;RPWP;;;place-sid-here) – Will Sep 24 '10 at 14:25

score 1 · Answer 2 · edited Apr 13 '17 at 12:14

1

Waiting for my VMs to spin up, but it looks like this should work (from reading this)

Open group policy to Computer Configuration\Policies\Windows Settings\Security Settings\System Services
Edit the service in question, enable "define policy setting" and then "edit security"
Add the user and give them "read" and "start, stop, and pause" rights

I'll swing by after I've tried this out, but good question! I had no idea this had been added.

This might also work: Remotely restarting a service for a non-administrator user

edited Apr 13 '17 at 12:14

Community

1

answered Aug 03 '10 at 13:24

Kara Marfia

7,892
5
32
56

When i go Configuration\Policies\Windows Settings\Security Settings there is no System Services :-( – Cédric Boivin Aug 03 '10 at 13:48
Hmm...maybe an R2/Win7 feature of Group Policy? Unfortunately, I don't have a way to test downlevel but mine matches @Kara. – Doug Luxem Aug 03 '10 at 13:58
That's very odd! You're on the domain controller, and it's 2008 server? – Kara Marfia Aug 03 '10 at 14:08
1

Ach, sounds like it's R2, bummer! – Kara Marfia Aug 03 '10 at 14:20
No i am not on the domain controller, i am on the server directly, because it's a custom service, install only on this machine. – Cédric Boivin Aug 03 '10 at 14:20
now I wonder if there's a way to add that custom service to the domain policy? assuming you're able to edit GP. Doug's answer seems more direct, though. ;) – Kara Marfia Aug 03 '10 at 22:38
Doesn't work on Win2008 R2 - there is no "System Services" item. – Alexander Gonchiy Mar 23 '18 at 13:18

How to give rights to one user for the restart of a service

2 Answers2

Linked