Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

How to restart a specific service, when non-administrator ; windows seven

Posted on 2011-03-24
11
Medium Priority
?
991 Views
Last Modified: 2012-05-11
Hi,
On a windows 7 business, used at home (no domain),
I'm trying to make my family (non-admin users) able to restart a specific service with a simple double-clic on an icon (some application that goes wrong sometimes)
Every method leads to a blocking situation. Something's always missing. Can you help?

1) I tried a simple .bat with "net stop/start myservice".
I tried a 3rd-party tool to elevate privileges automatically (http://www.winability.com/elevate/) to avoid these boring UAC confirmation windows. I don't want to disable UAC.
But, as it's a .bat, I can't modify its properties to "run as administrator" for everyone.

2) OK, then I compiled it as a .exe with some "bat to exe" tool.
Now I can modify its compatibility settings to make it run as administrator. Works for me, let say user "MYHOST\me".
BUT, the .exe is not signed, so "MYHOST\me" can confirm this other UAC window ("allow unknown publisher blah blah") it with a simple click, but "MYHOST\mywifeorchild" has to authenticate as the only admin user - MYHOST\me - for which they don't have the password.

3) Then I tried to create a scheduled task and a shortcut to it (http://www.sevenforums.com/tutorials/11949-elevated-program-shortcut-without-uac-prompt-create.html).
(By the way, I got rid of "elevate" program this way. My .bat is just "net stop / net start")
That's OK, I created my shortcut to "schtasks.exe /run /tn MyTask". Runs for MYHOST\me.
But MYHOST\mywife can't launch it "access denied". Furthermore, the task doesn't appear in the list, when she's logged in. Like the task is for one user only (I didn't know that). I tried different setting with the running user (me, her) and the "logged on or not" option. Still not working.

I thought there could be an answer here http://www.experts-exchange.com/OS/Microsoft_Operating_Systems/Windows/Windows_7/Q_26571977.html but I don't understand.

How can I finally make it possible? by either
- allowing one specific .exe as an exception for signed application check in UAC? some place in regedit?
- making this bat/exe/scheduled task/whatever runnable as admin for anyone?
- Add some specific permission to my non-admin users (something like LogonAsBatch?) luckily, a windows business might allow it (VS home edition)
- the script might be a powershell stuff as well, provided a non-admin can start it without authenticating.

Of course, I don't want them to get the full admin right.

Thank you,
0
Comment
Question by:mchkorg
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
11 Comments
 
LVL 5

Expert Comment

by:zazagor
ID: 35207297
0
 
LVL 7

Author Comment

by:mchkorg
ID: 35207561
OK, that's what I said : If I create my .exe from my .bat, I can set the permission you're talking about, BUT : UAC stills asks admin rights to confirm this unsigned binary is trustworthy.
And admin right means :
- a single click for me
- my password for the non-admin users
0
 

Assisted Solution

by:Noghri
Noghri earned 200 total points
ID: 35260568
The bit about the exe running and still asking for permission is because it is not signed with a trusted certificate. You could generate a signing authority, add the Signing Authority certificate to the trusted certificates, and then sign your application with a code signing certificate signed by your 'trusted' certificate.

Its an awkward way round, and you will have to keep those certificates pretty safe as they would allow people to sign any program and have it run 'trusted'. Ive not played with Root CA's on windows - I used the php-ca from sourceforge on a Linux box. Installing the MS RootCA on a windows machine has some far reaching implications if done on a domain!

I have had to do a simliar thing with macros as I didn't want the nag screens every time.
0
Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 27

Accepted Solution

by:
davorin earned 1800 total points
ID: 35261443
You can try to use tool like SetACL or SubInACL to set permissions on services:
http://helgeklein.com/
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=e8ba3e56-d8fe-4a91-93cf-ed6985e3927b&displaylang=en

I have not tried it on Windows 7, but maybe it will work.
0
 
LVL 7

Author Comment

by:mchkorg
ID: 35276546
I'll check this quickly, thank you
0
 
LVL 7

Author Comment

by:mchkorg
ID: 35308726
davorin, I tried setACL
I ran this as admin :
setacl -on "My service" -ot srv -ace "n:A-Non-Admin-User;p:start_stop,read" -actn ace

Open in new window


But it told me:
WARNING: Privilege 'Back up files and directories' could not be enabled. SetACL's powers are restricted.
WARNING: Privilege 'Restore files and directories' could not be enabled. SetACL's powers are restricted.
INFO: Processing ACL of: <My service>
ERROR: Writing SD to <My service> failed with: Access denied.

Open in new window


Strange thing: Windows didn't ask for elevated privileges when I started this command.
I tried to use "elevate setacl...", it all sys it's OK but when I list:
setacl -on "My service" -ot srv -actn list

Open in new window

I can't see any new permission.

Any idea?
0
 
LVL 7

Author Comment

by:mchkorg
ID: 35308745
OK, I tried with "subinacl"
It worked, the trick was to start the "cmd" as administrator.
Maybe it was the same for setacl.
The command was:

C:\Program Files\Windows Resource Kits\Tools>subinacl /service "My Service" /GRANT=MYHOST\My-user=TO

Open in new window



Results:
My Service : delete Perm. ACE 4 myhost\my-user
My Service : new ace for myhost\my-user
My Service : 2 change(s)


Elapsed Time: 00 00:00:00
Done:        1, Modified        1, Failed        0, Syntax errors        0
Last Done  : My Service

Open in new window


I used:
http://www.eventlogblog.com/blog/2007/11/setting-service-permissions-wi.html
and http://blogs.msdn.com/b/astebner/archive/2006/09/04/739820.aspx
0
 
LVL 7

Author Closing Comment

by:mchkorg
ID: 35308748
Thank you for pointing me to these tools.
0
 
LVL 27

Expert Comment

by:davorin
ID: 35308774
Temporary enabling built-in administrator account and starting a new command prompt with "runas /user:administrator cmd" should help with that problem.
0
 
LVL 27

Expert Comment

by:davorin
ID: 35308778
I type too slow ;)
I'm glad you have solved your problem and thx for points.
0

Featured Post

Important Lessons on Recovering from Petya

In their most recent webinar, Skyport Systems explores ways to isolate and protect critical databases to keep the core of your company safe from harm.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

New Windows 7 Installations take days for Windows-Updates to show up and install. This can easily be fixed. I have finally decided to write an article because this seems to get asked several times a day lately. This Article and the Links apply to…
When you try to extract and to view the contents of a Microsoft Update Standalone Package (MSU) for Windows Vista, you cannot extract the files from the MSU. Here we are going to explain how to extract those hotfix details without using any third pa…
This Micro Tutorial will teach you the basics of configuring your computer to improve its speed. It will also teach you how to disable programs that are running in the background simultaneously. This will be demonstrated using Windows 7 operating…
This Micro Tutorial will give you a basic overview of Windows Live Photo Gallery and show you various editing filters and touches to photos you can apply. This will be demonstrated using Windows Live Photo Gallery on Windows 7 operating system.

618 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question