Window Services start-stop permission to Remote Desktop users - windows-services

Question

I want to give MS SQL service start/stop permission to Remote Desktop users (not admin user). Can anyone have idea about this?

Answer 1

Step 1 – Create the Console
We need to open a hidden console snap-in
Click Start > Run (or press WIN + R) and type “mmc.exe”
This opens an empty Microsoft Management Console. Click File > Add/Remove Snap-in… (Ctrl + M)
Scroll down the list of available Snap-ins and select Security Configuration and Analysis
Click Add
Next select Security Templates
Click Add
Click OK
Step 2 – Create a blank Security Template
In Windows Server 2003 and below you can store these files anywhere but later versions have tougher restrictions so we will be creating everything in D:\Securtiy\
Right-click Security Templates from the console tree and select New Template Search Path …
Browse to D:\Security, or other local path, and click OK
Right-click D:\Security from the console tree and select New Template …
Give the new template a name, e.g. Custom Services. It doesn’t matter what you use.
The Description is optional but may be useful if you want to re-use it
Click OK and you will see the new template appear in the console
Step 3 – Create a Security Database
Right-click Security Configuration and Analysis from the console tree and select Open Database…
Browse to D:\Security, or other local path, and type a name in the File name: box e.gSecurity
Click OK. This creates an Security.sdb file that is used to apply the changes
An Import Template window appears. Browse to C:\Security/Custom Services.inf and selectOpen. This applies the template with all the local services to the database
If you get the error “The database you are attempting to open does not exist.” then you need to choose a different path i.e. on a local disk
Right-click Security Configuration and Analysis from the console tree and select Analyze Computer …
Click OK to accept the default log file path
You will then be presented with something that looks very similar to the Group Policy Editor or Local Security Policy Console
Step 4 Change Service Permissions
Double-Click System Services
Scroll down to find the service you need to change, MSSQLSERVER ,MSSQLAGENT
Double-Click the above mentioned services.
Tick the box Define this policy in the database:
Click the Edit Security … button
Click Add
Type in the user name of the Service account e.g. Remote Desktop User, and click OK
With the Remote Desktop User account selected, check the Allow permissions for Start, stop and pause
Click OK
Click OK on the Service Properties to bring you back to the console
You’ll notice the Service now has an ‘x’ on it and Investigate message on the Permission column. This is because the new permissions we’ve chosen conflict with what is on the local computer
Step 5 – Apply new Security Permissions
Right-click Security Configuration and Analysis from the console tree and select Configure Computer …
Click OK to accept the default log file path
This will apply the new custom permissions to the local computer
You can now test it out on the server with the Remote Desktop User account and test it works..