Controlling Services from a User Account

Starting Windows Services from a normal Windows User account (even with adminstrator rights) is normally not allowed. To enable this the User account has to be granted the right to start Windows Services on the server the services will run on. This has to be done on the server in question. Also the User Account Control settings have to be set to allow the User with Administrator rights to make change to the server without notifacations.

Controlling Windows Services

There are two ways to enable a User with Administrator rights to start/stop Windows Services: in the Properties of the installed Service or by adding the User account to the list of users allowed to start Windows Services.

List of allowed Users

On the server to run the Service on, open the Control Panel, go to the Administrative Tools and start the Local Security Policy management program by double clicking the Local Security Policy link. In the opened window navigate to Security Settings -> Local Policies -> User Rights Assignment and then in the right pane double click on 'Log on as a service'.




The dialog shown below will open. In this dialog click the Add User or Group button and add the User account to user for starting Windows Services to the list.



The added account can then be used for starting and stopping the installed Services and Managers.

Installed Service

On the server to run the Service on, open the Control Panel, go to the Administrative Tools and start the Services management program by double clicking the Services link. In this program right click the already installed Service or Manager and select Properties. In the opened dialog select the Log On tab, check the This account checkbox and enter the needed Domain Username and Password (twice) of the User account to use as shown in the example below. Then click Ok and the Service will from then on be started by using the added User account as Log On information.

User Account Control settings

To be able to install Services automated from the Control Center, the User Account Control mechanism should be disabled for Administrative accounts. This can be achieved in two ways: via the Control Panel -> User accounts or via Control Panel -> Administrative Tools -> Local Security Settings.

User Accounts

On the server to run the services on, open the Control Panel and then open the User Accounts dialog. In this dialog click the link 'Change User Account Control settings' to change the UAC settings. In the opened dialog pull the shown slider to the lowest position (Never notify) as shown below.



Then click Ok to save these new UAC settings. This will enable a User with administrator rights to install and register the Lion Services as regular Windows Services.

Note: A restart of the Server is needed for the changed UAC settings to take effect.

Local Security Policy

On the server to run the services on, open the Control Panel and then open the Adminstrative Tools dialog. In this dialog start the Local Security Policy manager by double clicking the corresponding link. In the opened program navigate to Security Settings -> Local Policies -> Security Options. Then in the right pane change the two options shown in the screenshot below from Enabled to Disabled.



This can be achieved by either double clicking the Security option or right clicking and selecting Properties. Then check the Disabled radio button and click Ok to save the changed setting.

Note: After changing botch Security Options a restart of the server is needed for the changed UAC settings to take effect.