![](/i/fill.gif) |
![](/i/fill.gif) |
|
![](/i/fill.gif) |
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
OK, so on the basis that somebody here might already know the answer to
this one...
I want to give certain users the power to stop and restart a specific
service at will. I can do this by adding them to the local
Administrators group - however, that would *also* give them the power to
log other users off of the PC, which I don't want. Is there some way to
allow them to control this service, but *not* allow them to kick people
off the PC?
Also, just for your amusement: The PCs in question run Windows NT 4.0
SP6a. >_<
Post a reply to this message
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
Invisible wrote:
> Also, just for your amusement: The PCs in question run Windows NT 4.0
> SP6a. >_<
Thoughts:
See if the service will run in a different group, or whether it needs to
have some sort of admin privs. Then give someone privileges to log in as
that group and control the service that way.
See if there's something in Group Policy that lists a specific stop/start
privilege for services. I'm talking under the "user rights assignment" table.
Third, write a "set uid" program and give it rights to impersonate the
administrator to start or stop the service.
Worse comes to worst, write a kludge program that runs all the time in the
administrators group and watches for a "start.txt" or "stop.txt" to be
created in a particular directory, then invokes the appropriate "net start"
and "net stop" commands. Note this solution takes no particular knowledge of
windows APIs and can be regulated just by giving whoever you want the
appropriate permissions on the appropriate directory.
--
Darren New, San Diego CA, USA (PST)
The NFL should go international. I'd pay to
see the Detroit Lions vs the Roman Catholics.
Post a reply to this message
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
Darren New wrote:
> Thoughts:
>
> See if the service will run in a different group, or whether it needs to
> have some sort of admin privs. Then give someone privileges to log in as
> that group and control the service that way.
>
> See if there's something in Group Policy that lists a specific
> stop/start privilege for services. I'm talking under the "user rights
> assignment" table.
>
> Third, write a "set uid" program and give it rights to impersonate the
> administrator to start or stop the service.
>
> Worse comes to worst, write a kludge program that runs all the time in
> the administrators group and watches for a "start.txt" or "stop.txt" to
> be created in a particular directory, then invokes the appropriate "net
> start" and "net stop" commands. Note this solution takes no particular
> knowledge of windows APIs and can be regulated just by giving whoever
> you want the appropriate permissions on the appropriate directory.
Doing some research, apparently it's not just files that can have
permissions. Registry keys, services, printers (??!) and so forth can
all have ACLs attached to them.
Not that you'd know that from the UI. :-P
Anyway, apparently Process Explorer has the power to show _and edit_ the
ACLs associated with a running service. (It's unclear whether it changes
the security token on the running process, or actually changes the
service configuration so that it will have the new security *every* time
it's run.)
Unfortunately, although this appears to work fine on Windows XP... [I'm
sure you see where I'm going with this.]
There's no huge problem with everybody having administrative rights over
the local machine, expect... that allows you to forcibly log other
people off the machine. Which would be "bad".
And now I'm wondering... maybe it's a "right" you can set? (As you may
remember, permissions apply to resources, rights apply to users.) I
wonder if I can either assign the "stop service" right to a user group,
or else create a mini-admins group and somehow revoke the "kick people
off" right?...
Otherwise, yeah, I'm going to end up writing some horribly hackish
script to kill and restart this damned service. :-(
--
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*
Post a reply to this message
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
Orchid XP v8 wrote:
> Doing some research, apparently it's not just files that can have
> permissions. Registry keys, services, printers (??!) and so forth can
> all have ACLs attached to them.
>
> Not that you'd know that from the UI. :-P
Huh...
Printer: http://i.techrepublic.com.com/gallery/60654-474-477.jpg
Post a reply to this message
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
[stupid Ctrl-Enter sending message immediately]
Nicolas Alvarez wrote:
> Orchid XP v8 wrote:
>> Doing some research, apparently it's not just files that can have
>> permissions. Registry keys, services, printers (??!) and so forth can
>> all have ACLs attached to them.
>>
>> Not that you'd know that from the UI. :-P
>
> Huh...
>
> Printer: http://i.techrepublic.com.com/gallery/60654-474-477.jpg
http://tinyurl.com/6xqhbr
Registry key:
http://www.eisenschmidt.com/jweisen/misc/lawson/registry_permissions.jpg
http://www.oucs.ox.ac.uk/viruses/itss/regpermissions.png
Service:
http://blog.binaryfactory.ca/wp-content/uploads/2008/05/gpodefault.jpg
Share:
http://www.get-digital-help.com/permissions-recorded-tv.png
Exchange mailbox:
http://tinyurl.com/6m4ere
etc
Post a reply to this message
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
Orchid XP v8 wrote:
> Doing some research, apparently it's not just files that can have
> permissions. Registry keys, services, printers (??!) and so forth can
> all have ACLs attached to them.
Um, sure. I hadn't heard of it with services, but the registry editor and
the printers both have property pages for security just like files do. You
might need to invoke regedt32 instead of regedit to get the version that has
the security stuff, IIRC.
And yes, everything has ACLs attached, including all your devices,
processes, connections, etc etc etc. Everything you can name in the kernel
has ACLs on it.
> Not that you'd know that from the UI. :-P
>
> Anyway, apparently Process Explorer has the power to show _and edit_ the
> ACLs associated with a running service. (It's unclear whether it changes
> the security token on the running process, or actually changes the
> service configuration so that it will have the new security *every* time
> it's run.)
It changes it next time it runs, if you change it from the service
configuration screens. (You know, the same set of tabs that shows you what
other services and stuff it depends on, not the "task manager"-like stuff. I
don't know which PE you're using there.)
I never tried setting up a service running as Fred and then had Fred try to
stop just that one. If that works, that would seem to be the way to go, if
you can.
> Unfortunately, although this appears to work fine on Windows XP... [I'm
> sure you see where I'm going with this.]
>
> There's no huge problem with everybody having administrative rights over
> the local machine, expect... that allows you to forcibly log other
> people off the machine. Which would be "bad".
>
> And now I'm wondering... maybe it's a "right" you can set?
That was my second suggestion. It'll likely be in the "user rights
assignment" list if it is. Maybe domain controllers have more of this sort
of thing than the individuals?
> Otherwise, yeah, I'm going to end up writing some horribly hackish
> script to kill and restart this damned service. :-(
It's that, or learning some deep Windows juju to invoke the LoginUser API to
change your own ownership when the program runs. Maybe you could have a "run
as" script?
Does this help?
http://www.codeguru.com/cpp/w-p/system/article.php/c5755
At least someone else wrote the hacky script for you. :-)
--
Darren New, San Diego CA, USA (PST)
The NFL should go international. I'd pay to
see the Detroit Lions vs the Roman Catholics.
Post a reply to this message
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
Nicolas Alvarez wrote:
>> Not that you'd know that from the UI. :-P
> Printer: http://i.techrepublic.com.com/gallery/60654-474-477.jpg
And as long as we're pointing out the obvious... :-)
This is from Vista. I think you need regedt32 to get the "permissions" tab
under pre-XP systems.
--
Darren New, San Diego CA, USA (PST)
The NFL should go international. I'd pay to
see the Detroit Lions vs the Roman Catholics.
Post a reply to this message
Attachments:
Download 'image1.gif' (37 KB)
Preview of image 'image1.gif'
![image1.gif](/povray.off-topic/attachment/%3C493d9034%40news.povray.org%3E/image1.gif?preview=1)
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
Nicolas Alvarez wrote:
> Service:
> http://blog.binaryfactory.ca/wp-content/uploads/2008/05/gpodefault.jpg
Hmmm... Where did you get that page from? It's not in my interface anywhere
obvious. Are you sure that's not specific to the print spooler?
--
Darren New, San Diego CA, USA (PST)
The NFL should go international. I'd pay to
see the Detroit Lions vs the Roman Catholics.
Post a reply to this message
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
http://support.microsoft.com/kb/256345/EN-US/
That says Windows 2000, but it might be similar on NT?
--
Darren New, San Diego CA, USA (PST)
The NFL should go international. I'd pay to
see the Detroit Lions vs the Roman Catholics.
Post a reply to this message
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
>> Doing some research, apparently it's not just files that can have
>> permissions. Registry keys, services, printers (??!) and so forth can
>> all have ACLs attached to them.
>>
>> Not that you'd know that from the UI. :-P
>
> Huh...
>
> Printer: http://i.techrepublic.com.com/gallery/60654-474-477.jpg
It's reasonably easy to overlook though. :-P
--
http://blog.orphi.me.uk/
http://www.zazzle.com/MathematicalOrchid*
Post a reply to this message
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |
| ![](/i/fill.gif) |
|
![](/i/fill.gif) |
|
![](/i/fill.gif) |
| ![](/i/fill.gif) |