Ledhed at 07:13, 4 April 2024

2024-04-04T07:13:41Z

Ledhed: Created page with "== Overview == Sometimes you need to grant a non-administrative user or group access to manage the state of a Windows service. == Disclaimer == The following article are my..."

2024-04-04T07:06:31Z

Created page with "== Overview == Sometimes you need to grant a non-administrative user or group access to manage the state of a Windows service. == Disclaimer == The following article are my..."

New page

== Overview ==
Sometimes you need to grant a non-administrative user or group access to manage the state of a Windows service.

== Disclaimer ==
The following article are my personal notes, if you choose to follow this article you do so at your own risk. I take no responsibility for the outcomes from following these steps!

== Security Templates Snap-In ==
* Open MMC.exe as administrator
* Add Snap-In 'Security Templates'
* Right click -> 'New Template'
* Expand the tree and click 'System Services'

Find the service(s) you want to modify permissions on edit. Check [X] Define this policy in the template. Then click the 'Edit Security' button. Add permissions to your liking, click ok when finished.
Right click the Template and click 'Save'

'''''CAUTION: Make sure your permissions at minimum have one account that has 'Full Control', otherwise you'll make it difficult to regain access to the service.'''''

== Security Configuration and Analysis Snap-In ==
While in the elevated MMC.
* Add Snap-In 'Security Configuration and Analysis'
* Right click -> 'Open Database'
* In the file dialog, navigate to the path you'd like to save your new security database, enter a name in the 'File name:' field and click 'Open'
* You should be prompted to select a Security Template to associate to the new DB, select the .inf file from the previous step.
* Right click -> 'Analyze Computer Now...'
* Expand the tree and click 'System Services', you should see a list of services with a red circle in the icon, this indicates deviations form the security template.
* Right click -> 'Configure Computer Now...'
At this point your service permissions should be set. Have the non-admin user test out their new access. If there are any errors, check the Security Configuration logs (probably saved in a log folder in the parent folder of where you saved the Template)

'''''NOTE: When I checked the 'System Services' I got an error saying something to the effect that it couldn't read the template. Fortunately, I did this on a test server so I ignored the error and the service permissions applied just fine. It also pays to have a current backup/snapshot.'''''

== Suggestions ==
* I highly advise using a group for permissions, especially in this scenario. It may be that you only need to grant one user access to restart a service, but if you have to add another (say because the previous user got hit by a bus), you just need to add the new user to the group rather than jump through all the MMC/Security Template nonsense all over again. Spend the extra 30 seconds and do your future self a huge favor.
* Managing permissions on Windows Services are a major pain. I don't know why MS didn't add a security tab to the Services MMC. That said, you should absolutely take a backup/snapshot of the system before making changes to services. If you lock yourself out of a service, reverting a snapshot is way faster than trying to figure out how to re-apply default permissions to a service.

== Reference ==
https://www.scriptinghouse.com/2017/04/set-windows-service-permission-to-non-administrator-accounts.html

[[category:Windows]]

← Older revision		Revision as of 07:13, 4 April 2024
Line 3:		Line 3:


−	== ~~Disclaimer~~ ==	+	== DISCLAIMER ==
−	~~The following~~ article ~~are my personal notes~~, ~~if you choose~~ to ~~follow this article you do~~ so at your ~~own risk~~. I ~~take no responsibility for the outcomes from following these steps~~!	+	<span style="color:red">
		+	This article uses some advanced administration steps. Any mistakes could put your service or system in an inoperable state. <br>
		+	Sanity check the steps below, I tend to paraphrase so use your best judgment. If you're unsure of what this article is doing, DON'T DO IT!<br>
		+	'' '''I AM NOT RESPONSIBLE FOR ANY DAMAGE YOU MAY CAUSE BY FOLLOWING THIS ARTICLE!''' ''
		+	</span>

Windows Service Permissions - Revision history

Ledhed at 07:13, 4 April 2024

Ledhed: Created page with "== Overview == Sometimes you need to grant a non-administrative user or group access to manage the state of a Windows service. == Disclaimer == The following article are my..."