| Administrators are usually the only people who have enough privileges to make system-wide |
| changes, including changes to system services that affect all users on a given computer. Sometimes |
| you may want a user to have control over a particular service without adding the user to an |
| To do this, you'll need a tool from Windows 2000 Server Resource Kit called Subinacl.exe. This |
| tool has many uses, including replacing security information for moved users, changing the owner |
| of an object, and migrating security information on objects. For this tip, we'll use Subinacl.exe to |
| grant a user specific access to a service. |
| Subinacl /service \\ComputerName\ServiceName /Grant=[DomainName\]UserName[=Access] |
| ComputerName is the name of the computer. If you leave it out, then the local computer is chosen. |
| ServiceName is the short name for the service. DomainName and UserName identify the user for |
| whom you're giving rights. Access is the access you're granting the user. |
| Subinacl /service \\mycomputer\spooler /grant=DOMAIN\John=F |
| This command will grant user John from domain DOMAIN Full Control over the Spooler service. |
| Consult Microsoft's site to learn about the tool's other options. |
| http://www.microsoft.com/windows2000/techinfo/reskit/en-us/default.asp |
First Previous Next Last |