In order to Start, Stop, and Pause a service, users need the following permissions:
Read
Stop, Start, and Pause
These permissions are only exposed in Group Policy.
You can create OUs that contain the workstations that you want the policy applied to.
To assign service permissions to the computers in an OU:
01. Open the Active Directory Users and Computers snap-in.
02. Right-click a domain and press New and Organizational Unit.
03. Name the OU and press OK.
04. Right-click this new OU and press Properties.
05. Select the Group Policy tab.
06. Press New and name the policy.
07. Highlight the new policy and press Edit.
08. Navigate to Computer Configuration / Windows Settings / Security Settings /System Services.
09. Double-click the service you want users to manage.
10. Check the Define this Policy Setting box.
11. Remove the Everyone group.
12. Add the System account, Domain Admins and any user or groups you desire.
13. Grant the System account and Domain Admins Full Control. Grant the other users and groups both Read and Stop, Start, and Pause permissions.
14. Press OK.
15. Change the startup mode from Disabled to Automatic or Manual.
16. Press Apply and OK.
17. Close the policy and press OK.
18. Move the computer accounts that you want effected into the OU.
NOTE: See tip 2184 » Windows 2000 Group Policy refresh.
