how to allow a user to restart a server service

[djc]

Archived from groups: microsoft.public.win2000.security (More info?)

I want to know if it is possible to do the following (and if so how?):

I am going away on vacation and I am the only one that can restart a certian
service that has a chronic problem of jamming up. Restarting it always fixes
it. This is what I have had to do until I can spend the appropriate time
getting to the root of the problem. Well, I need to allow someone else to be
able to restart this service while I'm gone. Making this person an
administrator is not an option. What can I do? I would like to give the
minimum amount of permission/privelege neccessary to allow a user to restart
a server service. Preferably from his own machine so I do not have to grant
him the 'log on locally' right on the server.

any input is greatly appreciated. Thanks.

 

[Dave]

Archived from groups: microsoft.public.win2000.security (More info?)

you are going away and leaving the company without a qualified admin to take
care of a known problem! shame on you! either fix it before you leave or
get someone who is qualified and trusted to stand in while you are gone.
maybe its time to hire a temp for your vacation time to sit there and watch
the server if its that important and prone to failure and you can't trust
fellow employees.

"djc" <noone@nowhere.com> wrote in message
news:uuTA20QZEHA.3692@TK2MSFTNGP09.phx.gbl...
> I want to know if it is possible to do the following (and if so how?):
>
> I am going away on vacation and I am the only one that can restart a
certian
> service that has a chronic problem of jamming up. Restarting it always
fixes
> it. This is what I have had to do until I can spend the appropriate time
> getting to the root of the problem. Well, I need to allow someone else to
be
> able to restart this service while I'm gone. Making this person an
> administrator is not an option. What can I do? I would like to give the
> minimum amount of permission/privelege neccessary to allow a user to
restart
> a server service. Preferably from his own machine so I do not have to
grant
> him the 'log on locally' right on the server.
>
> any input is greatly appreciated. Thanks.
>
>

 

[djc]

Archived from groups: microsoft.public.win2000.security (More info?)

Not all companies have the resources to have an IT 'team'. I am the team,
the whole team. There are higher priorities than this service which keep me
from fixing it. Plus, I was expecting someone a little more security
conscious than you obviously are responding to my post. Hiring a 'temp' and
giving them complete administrative control on the network does NOT sound
like a good idea to me. If I had a trusted person then thats a different
story. Please stop wasting my time.

there is a valid security question here that I still need an answer too.
anyone have a serious answer?


"Dave" <noone@nowhere.com> wrote in message
news:%23I0S$BRZEHA.3128@TK2MSFTNGP09.phx.gbl...
> you are going away and leaving the company without a qualified admin to
take
> care of a known problem! shame on you! either fix it before you leave or
> get someone who is qualified and trusted to stand in while you are gone.
> maybe its time to hire a temp for your vacation time to sit there and
watch
> the server if its that important and prone to failure and you can't trust
> fellow employees.
>
> "djc" <noone@nowhere.com> wrote in message
> news:uuTA20QZEHA.3692@TK2MSFTNGP09.phx.gbl...
> > I want to know if it is possible to do the following (and if so how?):
> >
> > I am going away on vacation and I am the only one that can restart a
> certian
> > service that has a chronic problem of jamming up. Restarting it always
> fixes
> > it. This is what I have had to do until I can spend the appropriate time
> > getting to the root of the problem. Well, I need to allow someone else
to
> be
> > able to restart this service while I'm gone. Making this person an
> > administrator is not an option. What can I do? I would like to give the
> > minimum amount of permission/privelege neccessary to allow a user to
> restart
> > a server service. Preferably from his own machine so I do not have to
> grant
> > him the 'log on locally' right on the server.
> >
> > any input is greatly appreciated. Thanks.
> >
> >
>
>

 

[Guest]

Archived from groups: microsoft.public.win2000.security (More info?)

djc wrote:

> I want to know if it is possible to do the following (and if so how?):
>
> I am going away on vacation and I am the only one that can restart a certian
> service that has a chronic problem of jamming up. Restarting it always fixes
> it. This is what I have had to do until I can spend the appropriate time
> getting to the root of the problem. Well, I need to allow someone else to be
> able to restart this service while I'm gone. Making this person an
> administrator is not an option. What can I do? I would like to give the
> minimum amount of permission/privelege neccessary to allow a user to restart
> a server service. Preferably from his own machine so I do not have to grant
> him the 'log on locally' right on the server.
Hi

Relevant for WinXP/Win2k3 as well:

HOW TO: Grant Users Rights to Manage Services in Windows 2000
http://support.microsoft.com/?kbid=288129

For method 3 in the article above:

A new, bug-fixed version of SubInACL.exe is available for download here
(Win2k/WinXP/Win2k3):

http://www.microsoft.com/downloads/details.aspx?FamilyID=e8ba3e56-d8fe-4a91-93cf-ed6985e3927b

SETACL (freeware) at http://setacl.sourceforge.net/ can also set permissions
on local or remote Win32 services.



To administer the service remotely, you can use SC.exe for this:


For WinXP and Win2k3 Server, SC.exe is built in. Look up SC.exe in the
computer's "Help and Support Center".


For Win2k:

Many of the ResKit utilities, including SC.EXE are available free at:

ftp://ftp.microsoft.com/reskit/win2000/

and

http://www.microsoft.com/windows2000/techinfo/reskit/tools/default.asp

More about SC here:
Sc.exe: Service Controller Tool
http://www.tburke.net/info/reskittools/topics/sc.htm



--
torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway
Administration scripting examples and an ONLINE version of
the 1328 page Scripting Guide:
http://www.microsoft.com/technet/community/scriptcenter/default.mspx

 

[djc]

Archived from groups: microsoft.public.win2000.security (More info?)

Thank you Torgeir. I will check this out immediately. I was replying to the
rude reply I got from 'Dave' and didn't see your reply yet. Thanks again. I
see you don't only live in the scripting groups. Good. You have been a great
help to me in the scripting groups as well!

thanks.


"Torgeir Bakken (MVP)" <Torgeir.Bakken-spam@hydro.com> wrote in message
news:elB5DKRZEHA.136@TK2MSFTNGP11.phx.gbl...
> djc wrote:
>
> > I want to know if it is possible to do the following (and if so how?):
> >
> > I am going away on vacation and I am the only one that can restart a
certian
> > service that has a chronic problem of jamming up. Restarting it always
fixes
> > it. This is what I have had to do until I can spend the appropriate time
> > getting to the root of the problem. Well, I need to allow someone else
to be
> > able to restart this service while I'm gone. Making this person an
> > administrator is not an option. What can I do? I would like to give the
> > minimum amount of permission/privelege neccessary to allow a user to
restart
> > a server service. Preferably from his own machine so I do not have to
grant
> > him the 'log on locally' right on the server.
> Hi
>
> Relevant for WinXP/Win2k3 as well:
>
> HOW TO: Grant Users Rights to Manage Services in Windows 2000
> http://support.microsoft.com/?kbid=288129
>
> For method 3 in the article above:
>
> A new, bug-fixed version of SubInACL.exe is available for download here
> (Win2k/WinXP/Win2k3):
>
>
http://www.microsoft.com/downloads/details.aspx?FamilyID=e8ba3e56-d8fe-4a91-93cf-ed6985e3927b
>
> SETACL (freeware) at http://setacl.sourceforge.net/ can also set
permissions
> on local or remote Win32 services.
>
>
>
> To administer the service remotely, you can use SC.exe for this:
>
>
> For WinXP and Win2k3 Server, SC.exe is built in. Look up SC.exe in the
> computer's "Help and Support Center".
>
>
> For Win2k:
>
> Many of the ResKit utilities, including SC.EXE are available free at:
>
> ftp://ftp.microsoft.com/reskit/win2000/
>
> and
>
> http://www.microsoft.com/windows2000/techinfo/reskit/tools/default.asp
>
> More about SC here:
> Sc.exe: Service Controller Tool
> http://www.tburke.net/info/reskittools/topics/sc.htm
>
>
>
> --
> torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway
> Administration scripting examples and an ONLINE version of
> the 1328 page Scripting Guide:
> http://www.microsoft.com/technet/community/scriptcenter/default.mspx