1

A persistent problem we have is that on our computers, our internet drivers crash when laptops move from place to place. In theory, we could solve this by giving the users a script to restart the driver with sc stop and sc start; in practice, we can't give our users admin permissions, and any method involving /SaveCred would be very time-intensive, as we have quite a few computers here. (Unless we can use SaveCred once on a server and let everyone just access that batch file? I don't know if that works.)

We're running Win10 with an Active Directory backend. Any help would be much appreciated. :)

1

Services (including drivers) have a security descriptor, in other words an ACL, similar to files and folders. This describes which users can use what controls (start, stop, pause, etc.)

You can retrieve the raw security descriptor via sc sdshow <svcname>, update it with new access rights, then use sc sdset ... to store it back. See this ServerFault thread for instructions on doing so manually.

You can probably set service permissions via Group Policy. Unfortunately the policy editor seems to list only built-in Windows services (with no ability to enter a custom name), although technically there's no reason it shouldn't be able to edit them.

Third-party programs also exist to edit service ACLs graphically. Personally I would use "Process Hacker" for this to build the desired SD on one computer, then grab it via sc sdshow and distribute that. There's also SubInACL, possibly PowerShell Set-Acl.

See also:

  • 1
    In theory, I should be able to use the domain controller to throw the sc sdset command into a startup script, and give Authenticated Users the right to start/stop those commands with RP/WP. That worked, but then when I tried to actually stop the service, the error shifted from "Access Denied" to [SC] ControlService FAILED 1052: The requested control is not valid for this service. Which is... great. So this may have been a waste of time. But thanks a lot for the answer! :) – J.Swersey Dec 3 '18 at 10:06

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.