Securing Windows services

[SC1959]

Is there a way natively with Windows to secure a specific service such that a

non-admin user can start/stop it but not any others (or have other admin

access on the system)? I thought perhaps you could set an ACL on a service

but the Control Panel UI doesn't seem to provide for that.

If this is not doable by default, are there any open source or commercial

products that provide something like this?

Thanks in advance.

 

[Steve Riley [MSFT]]

You could change the security descriptor of the service. Alas, there's no UI

way to do that, you'd have to bone up on SDDL.

Tell me more about what the service is and your need for giving users

control over it.

--

Steve Riley

steve.riley@microsoft.com

http://blogs.technet.com/steriley

http://www.protectyourwindowsnetwork.com

"SC1959" <SC1959@discussions.microsoft.com> wrote in message

news:BC08B52D-CA4A-4BA6-84DA-65E8CDF96D30@microsoft.com...<span style="color:blue">

> Is there a way natively with Windows to secure a specific service such

> that a

> non-admin user can start/stop it but not any others (or have other admin

> access on the system)? I thought perhaps you could set an ACL on a

> service

> but the Control Panel UI doesn't seem to provide for that.

>

> If this is not doable by default, are there any open source or commercial

> products that provide something like this?

>

> Thanks in advance. </span>

 

[S. Pidgorny]

http://support.microsoft.com/?id=288129

--

Svyatoslav Pidgorny, MS MVP - Security, MCSE

-= F1 is the key =-

http://sl.mvps.org http://msmvps.com/blogs/sp

"SC1959" <SC1959@discussions.microsoft.com> wrote in message

news:BC08B52D-CA4A-4BA6-84DA-65E8CDF96D30@microsoft.com...<span style="color:blue">

> Is there a way natively with Windows to secure a specific service such

> that a

> non-admin user can start/stop it but not any others (or have other admin

> access on the system)? I thought perhaps you could set an ACL on a

> service

> but the Control Panel UI doesn't seem to provide for that.

>

> If this is not doable by default, are there any open source or commercial

> products that provide something like this?

>

> Thanks in advance. </span>