Solved

Assign limited user account ability to start/stop service

Posted on 2008-10-30
4
1,352 Views
Last Modified: 2013-12-04
Hi Experts.  I have a small batch file that I wrote to stop and start three local services that relate to Websense so that I could backup the config and database files.  Since I will be running this through Task Scheduler, I realized I would have to provide a user account with the ability to stop/start those services.  I would rather not store the local admin username and password in Task Scheduler so the question is, what is the best practice for assigning an account to start and stop this service?  

I wanted to use something like a "services" account that would only be able to control the local services, not anything else.  I wasn't sure how to assign the local service account through Task Scheduler.  Any help would be appreciated.  This is a Windows 2003 server that is not a DC but does belong to an AD domain.

** I did do several google searches and found various SC commands but I wasn't sure how to use them.  Please don't provide just a link.  Make sure you add how to use the command.  Thanks.
0
Comment
Question by:samiam41
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
4 Comments
 
LVL 84

Accepted Solution

by:
oBdA earned 500 total points
ID: 22844494
Simply create a regular local or domain (if network access is required) account, give it the necessary permissions to do whatever else it needs to do (and make sure only adminstrators can change the batch script it's starting).
To allow this account access to the services (which a regular user doesn't have), you can use subinacl.exe (http://www.microsoft.com/downloads/details.aspx?FamilyID=E8BA3E56-D8FE-4A91-93CF-ED6985E3927B&displaylang=en) or a group policy.
Check here for details:
How to grant users rights to manage services in Windows 2000
http://support.microsoft.com/?kbid=288129
0
 
LVL 9

Author Comment

by:samiam41
ID: 22870673
oBdA!  Thanks for the post and info.  I will look through it this afternoon/evening and post any questions I have.  
0
 
LVL 9

Author Comment

by:samiam41
ID: 23079224
Can't believe I left this open.  My apologies friend.

Solution worked as expected.  Great work!
0
 
LVL 9

Author Closing Comment

by:samiam41
ID: 31511631
Always a pleasure to have you solve one of these annoying issues.  Take care and happy holidays!

Best Regards,
Aaron
0

Featured Post

Edgartown IT Case Study

Learn about Edgartown's quest to ensure the safety and security of the entire town's employee and citizen data. Read the case study!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Many of us in IT utilize a combination of roaming profiles and folder redirection to ensure user information carries over from one workstation to another; in my environment, it was to enable virtualization without needing a separate desktop for each…
Restoring deleted objects in Active Directory has been a standard feature in Active Directory for many years, yet some admins may not know what is available.
A short tutorial showing how to set up an email signature in Outlook on the Web (previously known as OWA). For free email signatures designs, visit https://www.mail-signatures.com/articles/signature-templates/?sts=6651 If you want to manage em…
In a recent question (https://www.experts-exchange.com/questions/29004105/Run-AutoHotkey-script-directly-from-Notepad.html) here at Experts Exchange, a member asked how to run an AutoHotkey script (.AHK) directly from Notepad++ (aka NPP). This video…

697 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question