How can I delegate permission for a user or group to control certain services?

A. By default, users can't control system services--they'll receive an "Error 5: Access is denied" error message. The following steps show how to use Group Policy to grant a user access to control the Print Spooler service.

1. Open the Group Policy Object (GPO) that contains the computers that need the users to be able to control services.
2. Navigate to the Computer Configuration, Windows Settings, Security Settings, System Services.
3. Double-click the service for which you want to delegate permissions (e.g., Print Spooler) as the figure shows.
4. Select the "Define this policy setting" and click Edit Security.
5. Click Add and enter the user/group to be given permissions.
6. After you select the user/group, pick the permissions you want to give to group members (e.g., "Start, stop and pause") and click OK, as the figure shows.
7. Ensure the services startup type is correct (e.g., Automatic) and click OK.
8. After the Group Policy has been applied to the target machines, the user/group given control will be able to perform the delegated actions.

To Start, Stop, and Pause a service, users need the Read and the Stop, Start, and Pause permissions. These permissions are exposed only through Group Policy. You can create organizational units (OUs) that contain the workstations that you want the policy applied to. To assign service permissions to the computers in an OU, perform these steps:

1. Open the Microsoft Management Console (MMC) Active Directory Users and Computers snap-in.
2. Right-click a domain and press New, Organizational Unit.
3. Name the OU and press OK.
4. Right-click this new OU and select Properties.
5. Select the Group Policy tab.
6. Press New and name the policy.
7. Highlight the new policy and select Edit.
8. Navigate to Computer Configuration, Windows Settings, Security Settings, System Services.
9. Double-click the service you want users to manage.
10. Select the "Define this Policy Setting" check box.
11. Remove the Everyone group.
12. Add the System account, Domain Admins, and any user or groups you desire.
13. Grant the System account and Domain Admins Full Control. Grant the other users and groups both Read and Stop, Start, and Pause permissions.
14. Click OK.
15. Change the startup mode from Disabled to Automatic or Manual.
16. Click Apply and OK.
17. Close the policy and press OK.
18. Move the computer accounts for which you want to apply the policy into the OU.