• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 398
  • Last Modified:

group policy service restriction prolicy

Hi Experts,

In my environment, everyone is a local administrator and I want to prevent some of the essential services to be disabled by them. I tried to use the "system services" policy in computer configuration -> windows settings -> security settings but I found difficulties to know what permission i need to assign to a particular service. I tried to follow what I found in the service.msc to assign full control to system, local service and network service but still no luck, it caused services like event viewer, firewall, WMI to stop startup.

What i have setup is like this, e.g, windows firewall, i tried 2 different permission set:-

set 1:
1> remove local administrators group
2> add local service and give it full permission
3> keep the default system permission (full)
4> keep the default interactive permission (read)
5> add domain admins to have full permission

set 2:
1> keep local administrators group and remove the "start, stop, pause" permission
2> keep the default system permission (full)
3> keep the default interactive permission (read)
4> add domain admin to have full permission

anyone know how or what I can do to achieve my goal?
0
nokyplease
Asked:
nokyplease
  • 4
  • 2
  • 2
  • +1
1 Solution
 
jsdrayCommented:
You're setting yourself up for a headache. ;)  Your best bet is to not give everyone local admin.  If they are trusted on their local machines, then let them kill what they want and deal with it.  If they are not trusted to stop certain services, then remove the user(s) from local admin.
0
 
nokypleaseAuthor Commented:
I can't because they need the local admin rights and I know best to not give them this permission.....
0
 
McKnifeCommented:
Hi.

You found the right spot to modify the ACLs of the services. Grant the right to start the service to domain admins and remove (NOT deny) the "stop service" privilege from administrators - that's all.

But be aware that local admins stay local admins - if they wanted, they could free themselves of GPO restrictions for good.
0
Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

 
LeeTutorretiredCommented:
I've requested that this question be deleted for the following reason:

Not enough information to confirm an answer.
0
 
nokypleaseAuthor Commented:
i still have problem of some services failed to start after i changed a lot of service ACL in group policy by removing the stop permission of local admins. do i need to specify the local service and/or network service as well in the group policy?
0
 
McKnifeCommented:
Ah, still there? :)
If you remove a stop permission, this will not result in anyone being able to start it.
Please quote the error on starting and also tell us what account is being used to start the service, account system or a user account?
0
 
LeeTutorretiredCommented:
I've requested that this question be deleted for the following reason:

Not enough information to confirm an answer.
0
 
McKnifeCommented:
Hi LeeTutor.

I had objected already.
http://www.experts-exchange.com/Software/Server_Software/File_Servers/Active_Directory/Q_28139284.html#a39199879 solves it as anyone can quickly verify. "
This is verifiable. If nokyplease ceases to respond, it is still verifiable as solution. Please do verify. As this is not nuclear physics but simple ACLs, the outcome is obvious. Stating "Not enough information to confirm an answer." makes me feel my efforts are being ignored, repeating it without further notice even ridicules them from my perspective.
0

Featured Post

Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

  • 4
  • 2
  • 2
  • +1
Tackle projects and never again get stuck behind a technical roadblock.
Join Now