It's there a way i can give the rights to a specific user, for restart a specific service on windows server 2008 ?
![](../../users/profiles/13647.webp)
- 31,092
- 9
- 65
- 87
![](../../users/profiles/16754.webp)
- 732
- 4
- 13
- 31
-
Pretty much the same thing: http://serverfault.com/questions/15147/how-do-i-give-a-domain-user-permission-to-start-and-stop-a-tomcat-service – Evan Anderson Aug 03 '10 at 14:14
-
2Possible duplicate of [How do I give a domain user permission to start and stop a Tomcat service?](https://serverfault.com/questions/15147/how-do-i-give-a-domain-user-permission-to-start-and-stop-a-tomcat-service) – Vadzim Sep 24 '18 at 10:30
2 Answers
You can use the sc command to set permissions on a specific service.
The format is a little difficult to understand, but first you will need to find the user or group's SID to use the command (something like "S-1-5-21-....").
sc myserver sdset spooler D:(A;;RPWP;;;place-sid-here)
A couple notes on that command:
- RP Allows service start
- WP Allows service stop
Replace myserver with your server's name and spooler with the service you want to edit.
More information is available at the following locations:
http://technet.microsoft.com/en-us/library/cc742037(WS.10).aspx
http://msmvps.com/blogs/erikr/archive/2007/09/26/set-permissions-on-a-specific-service-windows.aspx
![](../../users/profiles/5391.webp)
- 9,592
- 7
- 49
- 80
-
Additionally you need to prefix the entires with D: [as per my answer here](http://serverfault.com/questions/184279/give-users-the-right-to-restart-a-service/184338#184338). In your example, this would be: sc myserver sdset spooler D:(A;;RPWP;;;place-sid-here) – Will Sep 24 '10 at 14:25
Waiting for my VMs to spin up, but it looks like this should work (from reading this)
- Open group policy to Computer Configuration\Policies\Windows Settings\Security Settings\System Services
- Edit the service in question, enable "define policy setting" and then "edit security"
- Add the user and give them "read" and "start, stop, and pause" rights
I'll swing by after I've tried this out, but good question! I had no idea this had been added.
This might also work: Remotely restarting a service for a non-administrator user
![](../../users/profiles/1803.webp)
- 7,892
- 5
- 32
- 56
-
When i go Configuration\Policies\Windows Settings\Security Settings there is no System Services :-( – Cédric Boivin Aug 03 '10 at 13:48
-
Hmm...maybe an R2/Win7 feature of Group Policy? Unfortunately, I don't have a way to test downlevel but mine matches @Kara. – Doug Luxem Aug 03 '10 at 13:58
-
That's very odd! You're on the domain controller, and it's 2008 server? – Kara Marfia Aug 03 '10 at 14:08
-
1
-
No i am not on the domain controller, i am on the server directly, because it's a custom service, install only on this machine. – Cédric Boivin Aug 03 '10 at 14:20
-
now I wonder if there's a way to add that custom service to the domain policy? assuming you're able to edit GP. Doug's answer seems more direct, though. ;) – Kara Marfia Aug 03 '10 at 22:38
-
Doesn't work on Win2008 R2 - there is no "System Services" item. – Alexander Gonchiy Mar 23 '18 at 13:18