{"id":6822,"date":"2019-06-12T05:42:54","date_gmt":"2019-06-12T12:42:54","guid":{"rendered":"https:\/\/www.coretechnologies.com\/blog\/?p=6822"},"modified":"2020-08-10T10:01:32","modified_gmt":"2020-08-10T17:01:32","slug":"grant-service-start-stop-rights","status":"publish","type":"post","link":"https:\/\/www.coretechnologies.com\/blog\/alwaysup\/grant-service-start-stop-rights\/","title":{"rendered":"Q&A: How do I allow Non-Admins to Start\/Stop\/Restart my AlwaysUp Windows Services?"},"content":{"rendered":"
\"Q<\/div>\n
\n  I’m wanting to know what permissions a user is required to have in order to stop and start AlwaysUp<\/a> services. Is there a way to grant access to specific users<\/b> as I don’t want to have to give them full Admin rights? I’ve created shortcuts but getting the “access denied” message. Thanks in advance.<\/p>\n

— Bryant, Wide Bay Water<\/p>\n<\/div>\n

Hi Bryant.<\/p>\n

Typically, only administrators have the power to control Windows Services. That is an appropriate stance, as most services are administrative in nature.<\/p>\n

Indeed, it would be a huge mistake to allow non-privileged persons to stop any of the important tasks servicing the computer in the background. Think of the chaos it could cause!<\/p>\n

But there are always exceptions. And the good news is that Microsoft provides the ability to set granular permissions on each Windows Service. You can leverage that API\/functionality from command-line tools like Microsoft’s SubInACL<\/a> but your best option is to work directly with AlwaysUp (which is much easier to use).<\/p>\n

How to adjust the rights of an AlwaysUp Windows Service<\/h2>\n

Follow these steps to grant a non-admin user the ability to start and\/or stop your service:<\/p>\n

    \n
  1. \n

    Start AlwaysUp.<\/p>\n<\/li>\n

  2. \n

    Highlight\/select the application you wish to grant access to. Stop it if necessary.<\/p>\n<\/li>\n

  3. \n

    Select Application > Advanced > Service Security Settings<\/b> from the menu.<\/p>\n<\/li>\n

  4. \n

    In the Service Security Settings<\/b> window that comes up, select the user in the top pane. You will have to add the account if it’s not there.<\/p>\n<\/li>\n

  5. \n

    In lower pane, choose the permissions you wish the user to have.<\/p>\n

    Here you see us permitting user “Mike Jones” to read\/access and start (but not stop) the Plex Media Server service:<\/p>\n

  6. \n

    Save your changes.<\/p>\n<\/li>\n<\/ol>\n

    Afterwards, the user will be able to use the Services Control Panel application<\/a>, the NET command<\/a> or the SC utility<\/a> to manipulate the service created by AlwaysUp.<\/p>\n

    Remember: The user must work with the full, quoted name of the service, with the “managed by AlwaysUp” suffix. For example, if your application entry is named “VirtualBox” in AlwaysUp, the service will be named:<\/p>\n

    “VirtualBox (managed by AlwaysUp)”<\/p><\/blockquote>\n

    Easily adjust the rights of non-AlwaysUp Windows Services too!<\/h2>\n

    The instructions above will work for AlwaysUp services, but our free Service Security Editor<\/a> tool can adjust the permissions of any service<\/b>. Check it out if you need a general, portable solution for all your Windows Services.<\/p>\n