WINDOWS 2000 PROFESSIONAL

CONTROL USERS' ABILITY TO MANAGE SERVICES

In Windows 2000, members of the Administrators and Power Users groups can start, stop, pause, and resume services. In most situations, this security restriction is fine. Users generally don't require the ability to manage services on their own computers.

In some situations, however, you might want to grant an additional group of users the ability to manage services. One of the easiest ways to grant users the rights to manage services is to configure group policy settings. You can configure these rights at the site, domain, and OU levels; however, the policies aren't available at the local level.

To configure these rights, edit the group policy object from the Active Directory Users And Computers console. Follow these steps:

1. Browse to the Computer Configuration | Windows Settings | Security Settings | System Services branch.

2. Double-click the service whose policy you want to configure.

3. Select the Define This Policy Setting check box, and choose the Startup mode.

4. Click Edit Security, add the user or group, and grant the Start, Stop, and Pause permission to the newly added user or group.

5. Make sure the System account has Full Control, and click OK.

Repeat this process for any other services as needed.

You can also control service policies using security templates or the Subinacl tool (included with the Windows 2000 Resource Kit). For details on these two methods, as well as a script you can use to automate multiple changes, check out Microsoft Knowledge Base article 288129.

http://support.microsoft.com/?kbid=288129