Re: set service start permissions to Administrator only

George,

You can use security templates, with or without import to GPO,
to alter permissions on services; or you can use the sc utility.
Be careful however !! and do not use an XP even at up-to-date
SP 2 as it has a known error that can surface with service permission
modification via security templates/gpo

That said, you should not be having this problem.
I suspect that some other change you have made is causing this.
If the user account is not able to persist its Office mini-setup info,
then it will do it again, and again, etc. until it is able to save the
result. You have apparently made this persisting of result not allowed.

Roger

"George Valkov" <a@xxxxx> wrote in message
news:OEhI$pX4HHA.2752@xxxxxxxxxxxxxxxxxxxxxxx
Thank You for the replay, Mathieu, but this doesn't fix my problem.

I don't want any exceptions for any services. Limited uses must not be
able
to start services.


Now about Your suggestion, this is what I did to test it:

create account "testUser"
member in groups "Users", "Remote Desktop Users"
remote desktop to localhost, login as testUser
start Word, asks for Name and Initials...
Office 2007 setup starts and completes in 2 minutes.
Word displays "Privacy Options", I unchecked all
Quit Word.

Start Word again... Office 2007 setup again...
Word is ready for use in 2 minutes,

Disable and stop "Office Source Engine" service
Disable and stop "Windows Installer" service

Start Word... 'An error occurred and this feature
is no longer functioning properly. Please run
Setup and select "Repair..." to restore this
application."

Click OK -- Word shows and is ready to use!
No delays, no problems, no any kind of trouble!

I've tried reinstalling or repairing Office, but
nothing helps! This problem is ever since I
installed it for the first time. I also had the
same problem with Office 2003. I also had the same
problem in my previous and my current installation
of Windows 2003 server.

Well this could be because I've removed the "ShellNew"
for all of the office documents, of course Word wants
to restore it, but to prevent this I've set explicit
Deny permissions for changing that keys in the registry.



George Valkov



"Mathieu CHATEAU" wrote :
| Hello,
| Only administrators can start/stop services
|
| These services are exceptions, they are called to impersonate Office
through
| the MSI technology
|
| If you create a fresh user, it should only do that once, no more.
|
| --
| Cordialement,
| Mathieu CHATEAU
| http://lordoftheping.blogspot.com
|
|
| "George Valkov" <a@xxxxx> wrote in message
| news:eLg6HvR4HHA.4184@xxxxxxxxxxxxxxxxxxxxxxx
| > Hello everyone!
| > I'd like to know, how can I configure the permissions for a service so
| > that
| > only Administrators can start it.
| >
| >
| > I have a problem with Microsoft Office 2007 installed on Windows 2003
SP2
| > Enterprise. When I start for example Word as an Administrators
member -
| > all
| > seems just fine. But if I change that account to User or Power User
and
| > remove it from the Administrators group:
| >
| > When Word is started as a limited user, it starts Windows Installer
| > service
| > and Office Source Engine service. It takes about 2 minutes to complete
the
| > installation and Word is ready for use. But the next time he starts
Word,
| > it
| > starts installing again.
| >
| > On the other hand, if those two services are disabled, Word starts
just
| > fine
| > with no delays, no installations and is ready for use. So that's why
I'd
| > like to prevent limited users from starting those two services.
| >
| > Oh, by the way It will be much better if the limited users cannot
start
| > any
| > services or drivers at all. This will increase the security. Is there
any
| > such setting or group policy, and where?
| >
| >
| > Thank You for any help or web-link!
| >
| >
| > George Valkov
| >
| >
| >
|




.

Relevant Pages

  • Re: "Preparing to Install" Message - Word 2007 - No Solution ?
    ... Outlook 2007 Performance Update:http://pschmid.net/blog/2007/04/13/105 ... using the Windows Installer Cleanup Utility to remove any ... this it seems it could actually be a vista issue with permissions. ... references to registry keys that couldn't be accessed helped confirm ...
    (microsoft.public.office.misc)
  • Re: Event Log Trust Level?
    ... Any idea on what permissions to give ASPNET (registry ... I don't fancy the installer option. ... >What I do in this case is install the event log as part ... >> source, String logName, String machineName, Boolean ...
    (microsoft.public.dotnet.security)
  • Re: Hosted WinForms Controls and CAS
    ... this is part of an msi installer project - and should get you started... ... throw new ApplicationException("Failed to find the machine policy in the PolicyHierarchy"); ... // that includes whatever permissions we're granting ... CodeGroup cg = new UnionCodeGroup( ...
    (microsoft.public.dotnet.security)
  • Re: Hosted WinForms Controls and CAS
    ... this is part of an msi installer project - and should get you ... throw new ApplicationException("Failed to find the machine policy ... // that includes whatever permissions we're granting ... CodeGroup cg = new UnionCodeGroup( ...
    (microsoft.public.dotnet.security)
  • Re: Rebuild default ACLs on NTFS
    ... Here is a list of default permission on Windows 2000 ... Default NTFS Permissions in Windows 2000 ... How to apply predefined security templates in Windows Server 2003 ...
    (microsoft.public.windows.server.general)