set service start permissions to Administrator only



Hello everyone!
I'd like to know, how can I configure the permissions for a service so that
only Administrators can start it.


I have a problem with Microsoft Office 2007 installed on Windows 2003 SP2
Enterprise. When I start for example Word as an Administrators member - all
seems just fine. But if I change that account to User or Power User and
remove it from the Administrators group:

When Word is started as a limited user, it starts Windows Installer service
and Office Source Engine service. It takes about 2 minutes to complete the
installation and Word is ready for use. But the next time he starts Word, it
starts installing again.

On the other hand, if those two services are disabled, Word starts just fine
with no delays, no installations and is ready for use. So that's why I'd
like to prevent limited users from starting those two services.

Oh, by the way It will be much better if the limited users cannot start any
services or drivers at all. This will increase the security. Is there any
such setting or group policy, and where?


Thank You for any help or web-link!


George Valkov



.



Relevant Pages

  • Re: set service start permissions to Administrator only
    ... Thank You for the replay, Mathieu, but this doesn't fix my problem. ... Disable and stop "Windows Installer" service ... |> only Administrators can start it. ... |> like to prevent limited users from starting those two services. ...
    (microsoft.public.windows.server.security)
  • Re: set service start permissions to Administrator only
    ... Only administrators can start/stop services ... they are called to impersonate Office through the MSI technology ... When Word is started as a limited user, it starts Windows Installer service ... by the way It will be much better if the limited users cannot start any ...
    (microsoft.public.windows.server.security)
  • Re: Quick: Where is the equivalent of the Display control panel in Vista?
    ... know they have a pocket administrators guide. ... elevated to full administrator status by UAC. ... Assuming Windows recognizes the installer as an installer, ...
    (comp.sys.mac.advocacy)
  • Re: Quick: Where is the equivalent of the Display control panel in Vista?
    ... know they have a pocket administrators guide. ... but you keep coming up with crap about setup ... Assuming Windows recognizes the installer as an installer, ... automatically ask for elevation. ...
    (comp.sys.mac.advocacy)
  • Re: Permissions problems
    ... thanks for whoami I didn't know about that tool. ... I've found a way around it, by putting all the limited users into my ... and setting the Deny permissions on that rather ... > Yes administrators can be members of the users group and certainly will be ...
    (microsoft.public.windowsxp.security_admin)