Does anyone know of a way to give start/stop Services permissions to our 
Power Users group?  I know a GPO can be created to give permission to each 
seperate service but I would like to give start/atop permissions for _all_ 
services if possible.

Thanks,
  Nick 

Actually the power-users group goes away in 2008, so for future-proofing 
your plans, you may want to reconsider this plan.

What is the goal you are trying to accomplish? *WHY* do you want power-users 
to be able to restart services?

-Cliff


"Nick" <NoOne@NotHere.com> wrote in message 
news:uZtqO$4ZKHA.428@TK2MSFTNGP06.phx.gbl...
> Does anyone know of a way to give start/stop Services permissions to our 
> Power Users group?  I know a GPO can be created to give permission to each 
> seperate service but I would like to give start/atop permissions for _all_ 
> services if possible.
>
> Thanks,
>  Nick
> 

Want to allow our IT assistant to stop and start services but without giving 
full Admin rights.

"Cliff Galiher" <cgaliher@gmail.com> wrote in message 
news:u$EUKH9ZKHA.1596@TK2MSFTNGP06.phx.gbl...
> Actually the power-users group goes away in 2008, so for future-proofing 
> your plans, you may want to reconsider this plan.
>
> What is the goal you are trying to accomplish? *WHY* do you want 
> power-users to be able to restart services?
>
> -Cliff
>
>
> "Nick" <NoOne@NotHere.com> wrote in message 
> news:uZtqO$4ZKHA.428@TK2MSFTNGP06.phx.gbl...
>> Does anyone know of a way to give start/stop Services permissions to our 
>> Power Users group?  I know a GPO can be created to give permission to 
>> each seperate service but I would like to give start/atop permissions for 
>> _all_ services if possible.
>>
>> Thanks,
>>  Nick
>> 

Strange.   I don't think you'd want to do this (nor can I think of a way to) 
for two reasons.  But let me ask a few more questions.

Why would you *want* to do this?  You trust your assistant to stop services 
on your server, some of which are critical., but you don't want them to have 
administrative access?!?  This seems very strange to me.  They can do just 
as much damage *without* admin privileges at this point.  This seems like 
you are creating a false sense of security by trying to implement this 
restriction.

More importantly, from a technical perspective, if the user has access to 
services, then they can use that access to circumvent their own security 
credentials in many cases, so again, if this is a trust issue, it is trying 
to solve a staffing and policy issue with technology, which never works out.

So, back to my questions.  What services do you want them to stop or start? 
In most cases, services just "run."  If you are having to restart crashed 
services then again it is better to get to the root of the crash, not tap 
dance around it.  This just seems to be throwing the wrong solution at the 
problem no matter how I look at it, and since I can't think of a good way to 
accomplish what you are trying to do, I think it is now time to look at 
*why* you are trying to do it and see if there is a cleaner/better way.

-Cliff


"Nick" <NoOne@NotHere.com> wrote in message 
news:urZ1hesaKHA.544@TK2MSFTNGP05.phx.gbl...
> Want to allow our IT assistant to stop and start services but without 
> giving full Admin rights.
>
> "Cliff Galiher" <cgaliher@gmail.com> wrote in message 
> news:u$EUKH9ZKHA.1596@TK2MSFTNGP06.phx.gbl...
>> Actually the power-users group goes away in 2008, so for future-proofing 
>> your plans, you may want to reconsider this plan.
>>
>> What is the goal you are trying to accomplish? *WHY* do you want 
>> power-users to be able to restart services?
>>
>> -Cliff
>>
>>
>> "Nick" <NoOne@NotHere.com> wrote in message 
>> news:uZtqO$4ZKHA.428@TK2MSFTNGP06.phx.gbl...
>>> Does anyone know of a way to give start/stop Services permissions to our 
>>> Power Users group?  I know a GPO can be created to give permission to 
>>> each seperate service but I would like to give start/atop permissions 
>>> for _all_ services if possible.
>>>
>>> Thanks,
>>>  Nick
>>>
>
> 

An couple of examples:
1). We might have left the job of downloading and installing an MS update to 
one of our Power Users.  Quite often the updates icon is not present, the 
automatic updates service needs to be restarted before it appears.
2). Despite having the latest drivers available some printers still get 
blocked occassionally by a rogue document.  One of our Power Users could 
delete the offending file if that person had the ability to stop the Spooler 
service first.

Nick


"Cliff Galiher" <cgaliher@gmail.com> wrote in message 
news:%23pOfxTwaKHA.1648@TK2MSFTNGP05.phx.gbl...
> Strange.   I don't think you'd want to do this (nor can I think of a way 
> to) for two reasons.  But let me ask a few more questions.
>
> Why would you *want* to do this?  You trust your assistant to stop 
> services on your server, some of which are critical., but you don't want 
> them to have administrative access?!?  This seems very strange to me. 
> They can do just as much damage *without* admin privileges at this point. 
> This seems like you are creating a false sense of security by trying to 
> implement this restriction.
>
> More importantly, from a technical perspective, if the user has access to 
> services, then they can use that access to circumvent their own security 
> credentials in many cases, so again, if this is a trust issue, it is 
> trying to solve a staffing and policy issue with technology, which never 
> works out.
>
> So, back to my questions.  What services do you want them to stop or 
> start? In most cases, services just "run."  If you are having to restart 
> crashed services then again it is better to get to the root of the crash, 
> not tap dance around it.  This just seems to be throwing the wrong 
> solution at the problem no matter how I look at it, and since I can't 
> think of a good way to accomplish what you are trying to do, I think it is 
> now time to look at *why* you are trying to do it and see if there is a 
> cleaner/better way.
>
> -Cliff
>
>
> "Nick" <NoOne@NotHere.com> wrote in message 
> news:urZ1hesaKHA.544@TK2MSFTNGP05.phx.gbl...
>> Want to allow our IT assistant to stop and start services but without 
>> giving full Admin rights.
>>
>> "Cliff Galiher" <cgaliher@gmail.com> wrote in message 
>> news:u$EUKH9ZKHA.1596@TK2MSFTNGP06.phx.gbl...
>>> Actually the power-users group goes away in 2008, so for future-proofing 
>>> your plans, you may want to reconsider this plan.
>>>
>>> What is the goal you are trying to accomplish? *WHY* do you want 
>>> power-users to be able to restart services?
>>>
>>> -Cliff
>>>
>>>
>>> "Nick" <NoOne@NotHere.com> wrote in message 
>>> news:uZtqO$4ZKHA.428@TK2MSFTNGP06.phx.gbl...
>>>> Does anyone know of a way to give start/stop Services permissions to 
>>>> our Power Users group?  I know a GPO can be created to give permission 
>>>> to each seperate service but I would like to give start/atop 
>>>> permissions for _all_ services if possible.
>>>>
>>>> Thanks,
>>>>  Nick
>>>>
>>
>>