Solved

group policy service restriction prolicy

Posted on 2013-05-26
11
376 Views
Last Modified: 2013-07-15
Hi Experts,

In my environment, everyone is a local administrator and I want to prevent some of the essential services to be disabled by them. I tried to use the "system services" policy in computer configuration -> windows settings -> security settings but I found difficulties to know what permission i need to assign to a particular service. I tried to follow what I found in the service.msc to assign full control to system, local service and network service but still no luck, it caused services like event viewer, firewall, WMI to stop startup.

What i have setup is like this, e.g, windows firewall, i tried 2 different permission set:-

set 1:
1> remove local administrators group
2> add local service and give it full permission
3> keep the default system permission (full)
4> keep the default interactive permission (read)
5> add domain admins to have full permission

set 2:
1> keep local administrators group and remove the "start, stop, pause" permission
2> keep the default system permission (full)
3> keep the default interactive permission (read)
4> add domain admin to have full permission

anyone know how or what I can do to achieve my goal?
0
Comment
Question by:nokyplease
  • 4
  • 2
  • 2
  • +1
11 Comments
 
LVL 9

Expert Comment

by:jsdray
Comment Utility
You're setting yourself up for a headache. ;)  Your best bet is to not give everyone local admin.  If they are trusted on their local machines, then let them kill what they want and deal with it.  If they are not trusted to stop certain services, then remove the user(s) from local admin.
0
 

Author Comment

by:nokyplease
Comment Utility
I can't because they need the local admin rights and I know best to not give them this permission.....
0
 
LVL 53

Accepted Solution

by:
McKnife earned 500 total points
Comment Utility
Hi.

You found the right spot to modify the ACLs of the services. Grant the right to start the service to domain admins and remove (NOT deny) the "stop service" privilege from administrators - that's all.

But be aware that local admins stay local admins - if they wanted, they could free themselves of GPO restrictions for good.
0
 
LVL 59

Expert Comment

by:LeeTutor
Comment Utility
I've requested that this question be deleted for the following reason:

Not enough information to confirm an answer.
0
Get up to 2TB FREE CLOUD per backup license!

An exclusive Black Friday offer just for Expert Exchange audience! Buy any of our top-rated backup solutions & get up to 2TB free cloud per system! Perform local & cloud backup in the same step, and restore instantly—anytime, anywhere. Grab this deal now before it disappears!

 
LVL 53

Expert Comment

by:McKnife
Comment Utility
0
 

Author Comment

by:nokyplease
Comment Utility
i still have problem of some services failed to start after i changed a lot of service ACL in group policy by removing the stop permission of local admins. do i need to specify the local service and/or network service as well in the group policy?
0
 
LVL 53

Expert Comment

by:McKnife
Comment Utility
Ah, still there? :)
If you remove a stop permission, this will not result in anyone being able to start it.
Please quote the error on starting and also tell us what account is being used to start the service, account system or a user account?
0
 
LVL 59

Expert Comment

by:LeeTutor
Comment Utility
I've requested that this question be deleted for the following reason:

Not enough information to confirm an answer.
0
 
LVL 53

Expert Comment

by:McKnife
Comment Utility
Hi LeeTutor.

I had objected already.
" http://www.experts-exchange.com/Software/Server_Software/File_Servers/Active_Directory/Q_28139284.html#a39199879 solves it as anyone can quickly verify. "
This is verifiable. If nokyplease ceases to respond, it is still verifiable as solution. Please do verify. As this is not nuclear physics but simple ACLs, the outcome is obvious. Stating "Not enough information to confirm an answer." makes me feel my efforts are being ignored, repeating it without further notice even ridicules them from my perspective.
0

Featured Post

Want to promote your upcoming event?

Is your company attending an event or exhibiting at a trade show soon? Are you speaking at a conference? Spread the word by using a promotional banner in your email signature. This will ensure your organization’s most important contacts are in the know.

Join & Write a Comment

When you start your Windows 10 PC and got an "Operating system not found" error or just saw  "Auto repair for startup". After a while, you have entered a loop for Auto repair which does not fix anything and you will be in a  panic as all your work w…
Possible fixes for Windows 7 and Windows Server 2008 updating problem. Solutions mentioned are from Microsoft themselves. I started a case with them from our Microsoft Silver Partner option to open a case and get direct support from Microsoft. If s…
This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles from a Windows Server 2008 domain controller to a Windows Server 2012 domain controlle…
This Micro Tutorial will go in depth within Systems and Security in Windows 7 and will go into detail regarding Action Center, Windows Firewall, System, etc. This will be demonstrated using Windows 7 operating system.

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

14 Experts available now in Live!

Get 1:1 Help Now