Hot to allow Normal Users Start/Stop system services (Performance Logs and Alerts)

[Guest Jon Bakersfield]

So I've been through most every document out there about allowing users to

start/ stop services. However every one I've read is about a client box in

a domain where group policy is the solution.

 

The service in question (or at least the one I know of - it doesn't have

dependencies) is Performance Logs and Alerts.

 

I'm simply trying to allow a user to start/ stop services on a local

machine, but what I've found is that if I look at the local security policy

I cannot find anywhere to make this change. I've also looked in Security

Config and Analysis, Templates, etc. and found no answer.

 

Meanwhile RSOP.msc (resultant set of policies) which would display any

policies that were imposed on the system from other sources (eg. group

policy in a domain) shows that the policy folder is locked and none of the

policies set. Presumably because there is no remote policy enforced since

this is a standalone system.

 

The local computer policy snap-in does not display the system services

folder at all, so it appears that what I am looking for can ONLY be

accomplished via a domain environment.

 

NE1 found a way around this?

 

Thanks in advance!

[Guest Pegasus \(MVP\)]

Re: Hot to allow Normal Users Start/Stop system services (Performance Logs and Alerts)

 

Re: Hot to allow Normal Users Start/Stop system services (Performance Logs and Alerts)

 

 

"Jon Bakersfield" <JB@blingo.chartruse.com> wrote in message

news:eZzDnxIhIHA.5160@TK2MSFTNGP05.phx.gbl...

> So I've been through most every document out there about allowing users to

> start/ stop services. However every one I've read is about a client box

> in

> a domain where group policy is the solution.

>

> The service in question (or at least the one I know of - it doesn't have

> dependencies) is Performance Logs and Alerts.

>

> I'm simply trying to allow a user to start/ stop services on a local

> machine, but what I've found is that if I look at the local security

> policy

> I cannot find anywhere to make this change. I've also looked in Security

> Config and Analysis, Templates, etc. and found no answer.

>

> Meanwhile RSOP.msc (resultant set of policies) which would display any

> policies that were imposed on the system from other sources (eg. group

> policy in a domain) shows that the policy folder is locked and none of the

> policies set. Presumably because there is no remote policy enforced since

> this is a standalone system.

>

> The local computer policy snap-in does not display the system services

> folder at all, so it appears that what I am looking for can ONLY be

> accomplished via a domain environment.

>

> NE1 found a way around this?

>

> Thanks in advance!

>

 

You can let a normal user do anything by working indirectly with

a semaphore file. Here is how it works.

1. Create the batch file c:\Windows\StartStop.bat

@echo off

if "%1"=="" goto Action

echo net %1 perfmon > c:\Windows\StartStopService.bat

set verb=started

if /i %1==stop set verb=stopped

echo The service will be %verb% within 5 minutes.

pause

goto :eof

:Action

if exist c:\Windows\StartStopService.bat (

call c:\Windows\StartStopService.bat

del c:\Windows\StartStopService.bat

2. Give the user two shortcuts on his desktop.

Target for shortcut 1: c:\windows\StartStop.bat start

Target for shortcut 2: c:\windows\StartStop.bat stop

3. Create a scheduled job under an admin account.

It should run once every 5 minutes and invoke

c:\windows\StartStop.bat (with no parameters).