By default, starting and stopping Windows services are tasks that can only be performed by administrators. There are cases where you want regular users to be able to start or stop services. This can be easily accomplished using the subinacl.exe command-line tool.
This is the subinacl.exe syntax of how you can allow a normal user to start, stop, and pauze/continue a service.
subinacl.exe /service SERVICE_NAME /grant=COMPUTER_NAME\USERNAME=TOP
Note that the COMPUTER_NAME is optional. So you can also use:
subinacl.exe /service SERVICE_NAME /grant=USERNAME=TOP
The TOP privileges that are granted represent the following permissions:
- T : Start Service
- O : Stop Service
- P : Pause/Continue Service
The full list of permissions that can be granted or denied to a certain user are:
- F : Full Control
- R : Generic Read
- W : Generic Write
- X : Generic eXecute
- L : Read controL
- Q : Query Service Configuration
- S : Query Service Status
- E : Enumerate Dependent Services
- C : Service Change Configuration
- T : Start Service
- O : Stop Service
- P : Pause/Continue Service
- I : Interrogate Service
- U : Service User-Defined Control Commands