Nick

Does anyone know of a way to give start/stop Services permissions to our
Power Users group? I know a GPO can be created to give permission to each
seperate service but I would like to give start/atop permissions for _all_
services if possible.

Thanks,
Nick

Cliff Galiher

Actually the power-users group goes away in 2008, so for future-proofing
your plans, you may want to reconsider this plan.

What is the goal you are trying to accomplish? *WHY* do you want power-users
to be able to restart services?

-Cliff


"Nick" <NoOne@NotHere.com> wrote in message
news:uZtqO$4ZKHA.428@TK2MSFTNGP06.phx.gbl...
> Does anyone know of a way to give start/stop Services permissions to our
> Power Users group? I know a GPO can be created to give permission to each
> seperate service but I would like to give start/atop permissions for _all_
> services if possible.
>
> Thanks,
> Nick
>

Nick

Want to allow our IT assistant to stop and start services but without giving
full Admin rights.

"Cliff Galiher" <cgaliher@gmail.com> wrote in message
news:u$EUKH9ZKHA.1596@TK2MSFTNGP06.phx.gbl...
> Actually the power-users group goes away in 2008, so for future-proofing
> your plans, you may want to reconsider this plan.
>
> What is the goal you are trying to accomplish? *WHY* do you want
> power-users to be able to restart services?
>
> -Cliff
>
>
> "Nick" <NoOne@NotHere.com> wrote in message
> news:uZtqO$4ZKHA.428@TK2MSFTNGP06.phx.gbl...
>> Does anyone know of a way to give start/stop Services permissions to our
>> Power Users group? I know a GPO can be created to give permission to
>> each seperate service but I would like to give start/atop permissions for
>> _all_ services if possible.
>>
>> Thanks,
>> Nick
>>

Cliff Galiher

Strange. I don't think you'd want to do this (nor can I think of a way to)
for two reasons. But let me ask a few more questions.

Why would you *want* to do this? You trust your assistant to stop services
on your server, some of which are critical., but you don't want them to have
administrative access?!? This seems very strange to me. They can do just
as much damage *without* admin privileges at this point. This seems like
you are creating a false sense of security by trying to implement this
restriction.

More importantly, from a technical perspective, if the user has access to
services, then they can use that access to circumvent their own security
credentials in many cases, so again, if this is a trust issue, it is trying
to solve a staffing and policy issue with technology, which never works out.

So, back to my questions. What services do you want them to stop or start?
In most cases, services just "run." If you are having to restart crashed
services then again it is better to get to the root of the crash, not tap
dance around it. This just seems to be throwing the wrong solution at the
problem no matter how I look at it, and since I can't think of a good way to
accomplish what you are trying to do, I think it is now time to look at
*why* you are trying to do it and see if there is a cleaner/better way.

-Cliff


"Nick" <NoOne@NotHere.com> wrote in message
news:urZ1hesaKHA.544@TK2MSFTNGP05.phx.gbl...
> Want to allow our IT assistant to stop and start services but without
> giving full Admin rights.
>
> "Cliff Galiher" <cgaliher@gmail.com> wrote in message
> news:u$EUKH9ZKHA.1596@TK2MSFTNGP06.phx.gbl...
>> Actually the power-users group goes away in 2008, so for future-proofing
>> your plans, you may want to reconsider this plan.
>>
>> What is the goal you are trying to accomplish? *WHY* do you want
>> power-users to be able to restart services?
>>
>> -Cliff
>>
>>
>> "Nick" <NoOne@NotHere.com> wrote in message
>> news:uZtqO$4ZKHA.428@TK2MSFTNGP06.phx.gbl...
>>> Does anyone know of a way to give start/stop Services permissions to our
>>> Power Users group? I know a GPO can be created to give permission to
>>> each seperate service but I would like to give start/atop permissions
>>> for _all_ services if possible.
>>>
>>> Thanks,
>>> Nick
>>>
>
>

Nick

An couple of examples:
1). We might have left the job of downloading and installing an MS update to
one of our Power Users. Quite often the updates icon is not present, the
automatic updates service needs to be restarted before it appears.
2). Despite having the latest drivers available some printers still get
blocked occassionally by a rogue document. One of our Power Users could
delete the offending file if that person had the ability to stop the Spooler
service first.

Nick


"Cliff Galiher" <cgaliher@gmail.com> wrote in message
news:%23pOfxTwaKHA.1648@TK2MSFTNGP05.phx.gbl...
> Strange. I don't think you'd want to do this (nor can I think of a way
> to) for two reasons. But let me ask a few more questions.
>
> Why would you *want* to do this? You trust your assistant to stop
> services on your server, some of which are critical., but you don't want
> them to have administrative access?!? This seems very strange to me.
> They can do just as much damage *without* admin privileges at this point.
> This seems like you are creating a false sense of security by trying to
> implement this restriction.
>
> More importantly, from a technical perspective, if the user has access to
> services, then they can use that access to circumvent their own security
> credentials in many cases, so again, if this is a trust issue, it is
> trying to solve a staffing and policy issue with technology, which never
> works out.
>
> So, back to my questions. What services do you want them to stop or
> start? In most cases, services just "run." If you are having to restart
> crashed services then again it is better to get to the root of the crash,
> not tap dance around it. This just seems to be throwing the wrong
> solution at the problem no matter how I look at it, and since I can't
> think of a good way to accomplish what you are trying to do, I think it is
> now time to look at *why* you are trying to do it and see if there is a
> cleaner/better way.
>
> -Cliff
>
>
> "Nick" <NoOne@NotHere.com> wrote in message
> news:urZ1hesaKHA.544@TK2MSFTNGP05.phx.gbl...
>> Want to allow our IT assistant to stop and start services but without
>> giving full Admin rights.
>>
>> "Cliff Galiher" <cgaliher@gmail.com> wrote in message
>> news:u$EUKH9ZKHA.1596@TK2MSFTNGP06.phx.gbl...
>>> Actually the power-users group goes away in 2008, so for future-proofing
>>> your plans, you may want to reconsider this plan.
>>>
>>> What is the goal you are trying to accomplish? *WHY* do you want
>>> power-users to be able to restart services?
>>>
>>> -Cliff
>>>
>>>
>>> "Nick" <NoOne@NotHere.com> wrote in message
>>> news:uZtqO$4ZKHA.428@TK2MSFTNGP06.phx.gbl...
>>>> Does anyone know of a way to give start/stop Services permissions to
>>>> our Power Users group? I know a GPO can be created to give permission
>>>> to each seperate service but I would like to give start/atop
>>>> permissions for _all_ services if possible.
>>>>
>>>> Thanks,
>>>> Nick
>>>>
>>
>>