A Free Standalone GUI utility to Set Permissions for any Windows Service

Service Security Editor will help you to configure who can access your important Windows Services. It's an easy-to-use GUI alternative to Microsoft's powerful SC and SubInACL.exe command line programs. However, as with any other administrative tool, please use it with caution!

When you start Service Security Editor, it shows the list of the services running on your machine. From the dropdown, choose the service that you'd like to work with.

For example, we've selected the Print Spooler service in this screenshot:

After choosing your service from the list, click the Open button to pop up the service's standard Windows Service Security Settings window:

From there, select a user in the top portion and check the boxes lower down to grant or deny him whatever capabilities you see fit. Click the Add button to bring in an account not yet on the list. And of course, click the OK or Apply buttons to record your changes.

Granting a Non-Admin User Start & Stop Rights to a Service

For example, suppose you have a non-administrative user called Mike Jones who needs to restart the Print Spooler service when it acts up. Because he doesn't have the necessary rights, the Stop button is disabled when he opens the service from the Services Control Panel application:

1. Start Service Security Editor.

2. Select the Print Spooler service from the list:

   

3. Click the Open button to launch the Service Security Settings window:

   

4. Mike isn't on the list, so click on the Add button to open the Select Users or Groups window. Type in Mike's name and hit the OK button to return to the Security Settings window:

   

5. Mike's now on the list but with all permissions selected (the default). Since we only want to give him permission to start and stop the service, uncheck all but those two boxes and click the OK button:

   

6. Close Service Security Editor. Returning to the Print Spooler service's properties, we see that Mike can now stop the service.

   

Wasn't that easy?

Allowing a Non-Admin to Control a Service Remotely

Updating the service's permissions to empower a user is all well and good, but sometimes that isn't enough.

Specifically, if the user is not an administrator, any attempt to control the service may fail — even though you granted them full rights to do so!

It turns out that in Windows 10 (and Server 2016), Microsoft installed security barriers to block remote control of services. As a result, only users who are local administrators on a remote computer can start or stop services on that computer. This blog article discusses the situation.

Fortunately, Service Security Editor makes it easy for you to bypass Microsoft's additional security constraints. With a couple of clicks, you can easily add any Windows Service to the remote access check exemption list, which should allow your regular users to start or stop that service remotely.

For example, to ensure that Mike can start the Print Spooler service remotely:

1. Start Service Security Editor.
2. Select Print Spooler from the list of services.
3. Service Security Editor will let you know if Print Spooler is on the remote access check exemption list — the list of services that allow regular users to control them remotely. In this case it's not, and the message in the middle of the window says so:
   
4. To add Print Spooler to the remote access check exemption list, click the Add it button (pictured above).
5. And finally, confirm the addition by clicking Yes:
   

   Service Security Editor will add the service to the list and let you know that it's there:

   

   Note that you can easily remove the service from the exemption list by clicking the Remove it button.

And with that change in place, Mike will be able to start the Print Spooler service remotely — at least until Microsoft erects another security barrier!