This turned out to be a little tricky. If you want to schedule a net stop you need to use
c:\windows\system32\cmd /c net stop “yourservice”
and then for the Start in
c:\windows\system32\
And then click the
Run whether user is logged on or not
And then the final ticket is to check the !
Run with highest privileges
This post was very helpful in assembling this!
Filed under: Uncategorized | Leave a comment »
So the first thing you must know about SC.exe is that it REPLACES PERMISSIONS with what every you specify!
So, I was trying to figure out how to grant a user the right to start and stop a service. After reading this post
http://serverfault.com/questions/166641/how-to-give-rights-to-one-user-for-the-restart-of-a-service
I figured you could just get the sid of the current user. Using
whoami /all
And the using
Sc sdset myservice D:(A;;RPWP;;;place-sid-here)
unfortunately I didn’t know that this command will replace the current permissions on the service… so basically I was unable to see the service anymore…. oops. To get it back I opened up regedit and went to
HKEY_LOCAL_MACHINE/SYSTEM/CurrentControlSet/Services
and found the service and deleted the security key. When I rebooted it reset the security and then I was able to use the SC.exe command correctly.
The correct way to use it, is to first list the current permissions (sometimes you need to run an admin console) using
sc sdshow yourservice
then take that security gooblyguk and then add your security goobly guk to it and then you are good to go. This post explains it pretty good, you just have to pay attention!
1) Downloaded the Tomcat 5.5.27 Windows Service installer and installed it.
2) Dumped the TomCat5 service security descriptor using “sc sdshow tomcat5”, which showed me:
D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)This is a pretty common security descriptor for services. I’ve seen it verbatim on some Microsoft services. The SYSTEM and built-in Administrators have “full control”, “Power Users” can stop, start, and pause the service, and “Authenticated Users” can query properties of the service (I’m glossing over a bit here).
3) I created a limited user called “bob” on my box, opened a “RUNAS” command-prompt as him, and got his SID from “WHOAMI /ALL” (a command that’s on Windows Server 2003 but not on XP… don’t know about Vista and Windows 7 off the top of my head). I verified that Bob could not stop / start the Tomcat service (using “NET STOP tomcat5”). I received the same error you report in your post.
4) From my regular administrator command-prompt, ran the following:
sc sdset tomcat5 D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)(A;;RPWPDT;;;S-1-5-21-1409082233-484763869-854245398-1009)This SDDL string gives Bob’s SID (S-1-5-21-1409082233-484763869-854245398-1009) rights to stop, start, and pause the service (RP, WP, and DT, respectively).
Filed under: Uncategorized | Leave a comment »
