fastfrank

Hi,

Does anyone know of a way to restrict a user's privileges down to the point were they can only stop and start certain services?

Initially I've given the user 'Power User' rights but this opens their access up too much.

If I set specific services to start up as that user would that be the way to do it?

Comments appriciated.

Frank

BAH

You need to use the group policy's editor to make restrictions....

R1916v

As said, just create a policy for it, tie it to a group and add that user to the group.

Just make sure that the policy for the lockdown is higher up the chain than normal user privilages so it overrides any other groups they might be in.

David_Wallis

Usrmgr

Policies menu - User Rights - advanced user rights..

Try load and unload device drivers, if that doesnt work then maybe act as part of the operating system.

Cant remember exactly what is needed..

However ntconfig.pol (poledit) doesnt contain anything and cant make changes to allow you do stop and start services, all it can do is make changes to the registry as you login.

GPO's in 2k and 2k3 are completly different to nt4

I wouldnt do as suggested by giving a user priveledges then restrict by a policy these are very easy to get around..

and you can guarantee that someone will.

David

tooslow

On NT4 I would lock down the user rights to the bare minimum needed for them to work, then create logon and logoff scripts to start and stop the services.

Hope this helps.

Nog

Easy...

Change the permissions on the relevant HKLM\System\CurrentControlSet\Services\<service> key.

Cheers

Nog

David_Wallis

I thought about that but does the user need system rights to start and stop system services?

May also need to give them permissions to the actual exe for the service which will probably be in %systemroot%

Nog

Yep, but fastfrank wanted to be able to control specific services. So, just making the user a power user (for example) won't be sufficient. You'll need to frig registry permissions to stop the user(s) fiddling with stuff they shouldn't be.

Cheers

Nog

David_Wallis

ahh overlooked the specific services part..

allways easier for someone to explain what they want to achieve rather than this..

David