Allow non-administrators ability to Start/Stop services

I need to allow my QA group the ability to start/stop services on a member server and also allow them to be able to update a .bmp in the Windows directory. There is a .bmp that displays pertinent information on the desktop upon login. I do not want them to have full admin rights if I don't have to. If I add them as a power user, they are able to add themselves as a local admin. Thanks for the help.
LVL 2
jhwebb55Asked:
Who is Participating?
 
merowingerCommented:
on your memberserver make the following:

start->run->mmc

File->Add/Remove SnapIn->Security Templates->Add->OK
Now Expand the whole tree and make a rightclick
-> New Template -> Type a Name ->OK
->Expand your new Template->Go to Systemservices->and Define your settings on the specified service
->Right Click on your template->Save as -> Yourname.inf

So u created a template, now u have to import it to your local gpo
Start->Run->gpedit.msc
->Computer Configuration ->Windows Settings->Rightclick Security Settings->Import Security Template


Thats it :)
0
 
jhwebb55Author Commented:
Ok. After I posted this I saw the spot in GPMC where I can do this. The only problem is I can only see default system services, not ones that we have added for specific apps. I need them to be able to start/stop on all member servers in the domain. Will your steps above allow this on all member servers?
0
 
merowingerCommented:
sorry (my english) :) what do u mean with "i saw the spot"

When u create the template file on a server with the specified services,
they are included in the list!

For more servers....dont start gpedit.msc....create a policy or take a exsisting and make the same steps, as in gpedit.msc. Configure the security settings of this policy, that only specified servers shell apply this policy
0
Cloud Class® Course: Ruby Fundamentals

This course will introduce you to Ruby, as well as teach you about classes, methods, variables, data structures, loops, enumerable methods, and finishing touches.

 
merowingerCommented:
with the bmp do u mean bginfo.exe?

I would make this with file security settings (create a own group which only can list items in the windows folder....share the folder as \\server\win$
0
 
merowingerCommented:
..and for the pic give read rights
0
 
jhwebb55Author Commented:
Sorry. I meant I saw the location in the group policy editor where I could make that change. I have imported the template and configured it. I will check to see if it worked in a bit.

Yes, merowinger, I am talking about the bginfo.exe file. I will make that change at the file level and see if that works. Stay tuned. Thanks for the help.
0
 
jhwebb55Author Commented:
Both of your solutions worked perfectly. Thanks
0
 
merowingerCommented:
tanks too!
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.