hillda01 Posted July 21, 2008 Report Share Posted July 21, 2008 Hi...Hope someone can help...Some of my users keep disabling some Windows Services, they are administrators of the computers which I cant get around but is it possible to deny them the rights to disable some of the services within Windows?RegardsDave Quote Link to comment Share on other sites More sharing options...
Tanmaya Posted July 21, 2008 Report Share Posted July 21, 2008 Hi Dave, Are you looking for Local System Security Policy or Domain Security Policy? If it is for Local System, then only option is to remove those particular users from Administrator Group. And if it is for the Domain, then you can configure Group Policy for an OU and add those user in that particular OU to restrict them. Quote Link to comment Share on other sites More sharing options...
hillda01 Posted July 21, 2008 Author Report Share Posted July 21, 2008 Hi Dave, Are you looking for Local System Security Policy or Domain Security Policy? If it is for Local System, then only option is to remove those particular users from Administrator Group. And if it is for the Domain, then you can configure Group Policy for an OU and add those user in that particular OU to restrict them. All the PC's are in a member of a domain so I could apply a group policy to the machines...What part of the policy would I need to configure?RegardsDAve Quote Link to comment Share on other sites More sharing options...
Tanmaya Posted July 22, 2008 Report Share Posted July 22, 2008 Hi Dave,You can check Group Policy Settings for further investigation. I have not tested it. B) You will need to find out the exact template as per your requirement. Quote Link to comment Share on other sites More sharing options...
hillda01 Posted July 22, 2008 Author Report Share Posted July 22, 2008 Hi Dave,You can check Group Policy Settings for further investigation. I have not tested it. B) You will need to find out the exact template as per your requirement. That is a right long spreadsheet to wade through... :-(I can't see the setting I need to alter :-( Quote Link to comment Share on other sites More sharing options...
Tanmaya Posted July 22, 2008 Report Share Posted July 22, 2008 Ok Dave,I have got simplest solution, it will surely help you. You will need to login to the System, where you want to apply Services restriction for certain group,i) Create one OU, add those users to whom you want to restrict the services.msc access in that.ii) Go to C:\windows\system32\services.msc. Right Click this file>Property>Security. Under Security Tab, Add that domain group and Deny that group from accessing the file. And allow Your login to access this file.iii) Do not remove 'SYSTEM' users rights to access this file. Quote Link to comment Share on other sites More sharing options...
hillda01 Posted July 22, 2008 Author Report Share Posted July 22, 2008 Ok Dave,I have got simplest solution, it will surely help you. You will need to login to the System, where you want to apply Services restriction for certain group,i) Create one OU, add those users to whom you want to restrict the services.msc access in that.ii) Go to C:\windows\system32\services.msc. Right Click this file>Property>Security. Under Security Tab, Add that domain group and Deny that group from accessing the file. And allow Your login to access this file.iii) Do not remove 'SYSTEM' users rights to access this file. Ah I see what you are getting at - litterally deny ntfs permissions to the services mmc.... Quote Link to comment Share on other sites More sharing options...
Tanmaya Posted July 22, 2008 Report Share Posted July 22, 2008 Hi,Ah I see what you are getting at - litterally deny ntfs permissions to the services mmc....Hope this has resolved your problem! Quote Link to comment Share on other sites More sharing options...
hillda01 Posted July 23, 2008 Author Report Share Posted July 23, 2008 Hi,Ah I see what you are getting at - litterally deny ntfs permissions to the services mmc....Hope this has resolved your problem! Its a very good suggestion but I would like to see someway of deny a user to stop an individual service.We use McAfee for our AV and that has the option to stop users from stopping the service, I thought they would just leverage some type of configuration from within windows...RegardsDave Quote Link to comment Share on other sites More sharing options...
Tanmaya Posted July 23, 2008 Report Share Posted July 23, 2008 Hi Dave,As we can restrict services.msc for particular user group. In the same way, we can restrict each process. You will need to open services.msc, there you will need to check each service path in its property page. Go to that path, Right Click the file>Property>Security. Under Security Tab, Add that domain group and Deny that group from accessing the file. And allow Your login to access this file. Same as before. :) Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.