JSI Tip 3897. How do I script the right for a user to manage all Windows 2000 services?

In tip 3896, we learned how to use SUBINACL to grant a user the right to manage a service.

If you wish to grant the right to manage all services on a computer, copy/paste the following to SvcGrant.vbs:

jsiDomain= Wscript.Arguments.Item(0)'domain of computer account
jsiComputer = Wscript.Arguments.Item(1)'netbios ComputerName
jsiUserName = Wscript.Arguments.Item(2)'UserName (in the domain)
jsiPerm= Wscript.Arguments.Item(3)'access code
'bind to ComputerName
set objTarget = GetObject("WinNT://" & jsiDomain & "/" & jsiComputer & ",computer")
'create a shell object for call to subinacl
set objCMD = CreateObject("Wscript.Shell")
'get list of services
objTarget.filter = Array("Service")
For each Service in objTarget
command = "subinacl /service " & Service.name & " /grant=" & jsiUserName & "=" & jsiPerm
objCMD.Run command, 0
'report the services
Wscript.Echo "User granted access to " & Service.name & " "
NOTE: This script does NOT perform any error checking.

To run the script:

CSCRIPT <Drive:>\Folder\Svcgrant.vbs DomainName ComputerName UserName Access


CSCRIPT C:\Util\Svcgrant.vbs JSIINC JSI015 Jennifer F

The above displays:

Microsoft (R) Windows Script Host Version 5.1 for Windows
Copyright (C) Microsoft Corporation 1996-1999. All rights reserved.

User granted access to Alerter
User granted access to AppMgmt
. . .
. . .
User granted access to W32Time
User granted access to W3SVC
User granted access to WinMgmt
User granted access to WMDM PMSP Service
User granted access to Wmi
NOTE: If you don't want the display, remove the following from the script:

'report the services
Wscript.Echo "User granted access to " & Service.name & " "

Hide comments


  • Allowed HTML tags: <em> <strong> <blockquote> <br> <p>

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.