RE: Remotely Manage Windows Service

Your first command should have been:
sc \\server start w3svc
(hence the syntax error)

I'd try labbing this to make sure it's not an issue with your deployment.
I'd also use a service without the complex dependancies for testing.

Good luck,
Erik
--
MCSE:Messaging 2003, MVP

This post is provided "AS IS" and without warranty, expressed or implied. In
no event shall I be liable for any damages resulting from the application of
the posted content


"john d" wrote:

Not much luck with the SC command and I can't seem to find much of any
resources regarding this issue on the web. The sc results are below and I
have replaced the server and service names.

C:\sc start \\server w3svc
[SC] StartService: OpenService FAILED 123:

The filename, directory name, or volume label syntax is incorrect.


C:\sc \\server query
[SC] OpenSCManager FAILED 5:

Access is denied.


C:\sc \\server getkeyname servicename
[SC] OpenSCManager FAILED 5:

Access is denied.


Any ideas? If not to resolve this, perhaps another method for allowing a
remote user to start/stop a service without being an administrator.


"Erik Szewczyk [MVP]" wrote:

It's been a while since I've played with granting non-admins privilages to
services however as memory serves they arent going to be able to do it with
the MMC since they only get privilages over the service (not the database).

Some things to check/try:
* Make sure you've applied the policy with the "Configure Computer Now"
command (otherwise it will get defined in the database but never applied to
the computer).
* I'd also try starting/stopping the service using the "SC" command to see
if it also gets access denied.

Good luck,
Erik
--
MCSE:Messaging 2003, MVP

This post is provided "AS IS" and without warranty, expressed or implied. In
no event shall I be liable for any damages resulting from the application of
the posted content


"john d" wrote:

I need to allow a user to remotely start and stop a single designated service
on a 2003 server machine without making them a local administrator.

I attempted to use a security template on the server to specify permissions
for this user for the desired service as per KB 325349,
http://support.microsoft.com/kb/325349/en-us. However, the user still cannot
start or stop the service using both the MMC or the netsvc utility. When
using MMC, the error is "Unable to open service control manager database on
\\server Error 5: Access is denied." When using the netsvc command, the
error is also "Access is denied."

Please note that if I make the user a local administrator, they can access
all services via the MMC for the server, but the netsvc command still says
"Access is Denied". On the other hand, if I log in as one of the domain
admin accounts, which is also a member of the local administrator group, and
run the netsvc command, I can successfully start and stop the service.

At this point I am stuck and either need to resolve one of the existing
issues with MMC or NETSVC or come up with an alternate solution.


.

Relevant Pages

  • RE: Remotely Manage Windows Service
    ... Not much luck with the SC command and I can't seem to find much of any ... the MMC since they only get privilages over the service. ... Please note that if I make the user a local administrator, ... all services via the MMC for the server, but the netsvc command still says ...
    (microsoft.public.windows.server.general)
  • Re: Restricted Groups - Local Users Group
    ... back into restricted groups my policy worked fine. ... > access can run the command secedit.msc to open and edit Local Security ... Then run the command net group "domain admins" on ... > group nesting will be a local administrator on the domain computers. ...
    (microsoft.public.windows.group_policy)
  • Re: MMC Services startup control
    ... Do you like to control service in MMC or command line? ... With MMC, you can click on the Windows Logo button located on the bottom left corner and type "mmc" in the Start Search text box right above it. ... Select Service and click on the Add button to add it to your MMC window and then click on OK. ...
    (microsoft.public.windows.vista.general)
  • Re: Restricted Groups - Local Users Group
    ... access can run the command secedit.msc to open and edit Local Security ... Then logon to the computer as the local administrator [non domain ... is also in the domain admins group either directly or via group nesting will ... >> Users and Groups check the membership of the domain admins group to make ...
    (microsoft.public.windows.group_policy)
  • RE: Wireless Zero Configuration
    ... must be running because the notebook is connected to the Internet and Outlook ... What should I do to determine why MMC fails to detect these serices? ... Type the name of the console you want to use at the command prompt, ... Configuration do not appear in my list of services. ...
    (microsoft.public.windowsxp.general)