Modifying Win2k3 ACL for Services

[MaluMan]

Anyone familiar with changing permissions on services (Windows 2k3)? I was reading MS's website, and it says use MMC along with Security Templates. Along that lines, if I create a new template, and I apply it, do ALL my previous settings get set to "not defined" or are the only changes that take place the ones I've explicity defined in the new security policy?

Plus, is there an easier way to change permissions of services??

Thanks for the help.

 

[Smilin]

"not defined" means that setting will remain unchanged from it's current setting.

What are you trying to do exactly?

 

[MaluMan]

I have about 10 services that are disabled, but I need to set thier permissions so that "Power Users" can't change them. Currently Admins, Power Users, and System can modify services. Within MMC you can specify permissions for services, but the only way to modify those settings (from what I can tell) is by importing a custom sercurity template with the settings you want ..

and I don't want to change any of the current settings, just the permissions on the disabled services

thanks for your help!

 

[stash]

Easy solution. Don't make people power users. Power users is not an effective way of limiting people as you are finding out.

 

[MaluMan]

Well the thing is I won't be managing the server after setting it up so I have no control over user's and their group.... I was thinking of deleting the entire Power Users group altogether but I can't delete built-in accounts (unless anyone knows a work around??)