Announcement

Collapse
No announcement yet.

How to control services...?

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • How to control services...?

    Could anyone give me a clue how to allow someone permissions to start and stop the spooler service on a combination server? (i.e. a server which is doing file & print and is a domain controller). There's no security tab on a service, and I don't want to make the users in question up to domain admins... I just want to allow them to manage, install, remove and support printers which are "served" from domain controllers. For installing, supporting and removing I have granted them "Full Control" permissions to the C:\Windows\system32\spool directory on each box... but I'm stuck on allowing them to stop and restart the service.

    p.s. multiple domain forest at Windows Server 2003 forest and domain functional levels; one "empty root" domain with 5 children and 2 grandchildren of different parents. Print services are served in the main from dedicated print servers in one of the children but some sites on slower connections and/or small user-bases have their print and file served from their local domain controller - which could be in any of the "child" domains. No printing is serviced by the grandchildren domains.

    Help please?


    Tom
    For my own and your protection, I do not provide support by private message under any circumstances. All such messages will be deleted and ignored.

    Anything you say will be misquoted and used against you

  • #2
    Re: How to control services...?

    If print server is also DC or it is member server in domain, try to look for solution in Active Directory groups.
    Did not you try to include user into Print Operators ?
    If this will not functional Server Operators surely can start/stop services.

    Joe

    Comment


    • #3
      Re: How to control services...?

      OK - bit of testing done here.

      Server Operators cannot start and stop services on Domain Controllers. Nor can Print Operators.

      Therefore we're back to our original question - how do I grant the ability to start and stop services on Domain Controllers without granting Domain Admin membership?

      Thanks


      Tom
      For my own and your protection, I do not provide support by private message under any circumstances. All such messages will be deleted and ignored.

      Anything you say will be misquoted and used against you

      Comment


      • #4
        Re: How to control services...?

        Check out this link?
        http://www.eggheadcafe.com/software/...domain-us.aspx
        CHange permissions on the service through GP
        Tom Jones
        MCT, MCSE (2000:Security & 2003), MCSA:Security & Messaging, MCDBA, MCDST, MCITP(EA, EMA, SA, EDA, ES, CS), MCTS, MCP, Sec+
        PhD, MSc, FIAP, MIITT
        IT Trainer / Consultant
        Ossian Ltd
        Scotland

        ** Remember to give credit where credit is due and leave reputation points where appropriate **

        Comment


        • #5
          Re: How to control services...?

          Brilliant, thank you. I had actually stumbled across the "Services" GP leg just after I last posted; but then I had the "TCP/IP Print Server" service (it's dependant upon the Print Spooler Service) on the DC and couldn't see it in the GPO editor...

          The article you posted showed me the way. Thanks very much.


          Tom
          For my own and your protection, I do not provide support by private message under any circumstances. All such messages will be deleted and ignored.

          Anything you say will be misquoted and used against you

          Comment


          • #6
            Re: How to control services...?

            Ooh, lovely rep points!

            Thank you
            Tom Jones
            MCT, MCSE (2000:Security & 2003), MCSA:Security & Messaging, MCDBA, MCDST, MCITP(EA, EMA, SA, EDA, ES, CS), MCTS, MCP, Sec+
            PhD, MSc, FIAP, MIITT
            IT Trainer / Consultant
            Ossian Ltd
            Scotland

            ** Remember to give credit where credit is due and leave reputation points where appropriate **

            Comment

            Working...
            X