Grant access to stop and start a service on an on premise domain controller without domain admin rights

Question

question

PatReagan-9330 asked Jul 29, '20 PatReagan-9330 answered Jul 30, '20

Grant access to stop and start a service on an on premise domain controller without domain admin rights

Due to a successful breach during a pen test by using the print spooler service on a domain controller, we are being challenged to stop/disable the print spooler service on all of our domain controllers. With the pruning responsibility of the print spooler on a domain controller for domain published printers, we would like to schedule a start and stop of the print spooler service on a DC using a scheduled task. We attempted to use the Local Service account to run the task, but it fails to start the service with no errors or warning in the logs. We need to complete this task as a non domain administrator. Any suggestions?

windows-server-2016

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 1 · 2020-07-30T18:13:11.997Z

PatReagan-9330 answered Jul 30, '20

OK. So we used a GPO to set the service to manual, and deliver a a scheduled task, using System context to run the process. No account required to give access to the DC.

Hope this helps someone else!

Thanks

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 2 · 2020-07-29T16:28:31.72Z

LeonLaude answered Jul 29, '20

Hi,

Have you tried giving Windows service permissions to a domain account by using the SC.exe (Service controller) tool?

How to Allow Non-Admin Users to Start/Stop Windows Service?
http://woshub.com/set-permissions-on-windows-service/

Best regards,
Leon

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

Answer 3 · 2020-07-29T16:58:14.897Z

PatReagan-9330 answered Jul 29, '20

We have thought about this option. But don't know if changing the permissions for a service on a DC can cause issues since the service is used to interact with the domain. Or am I over thinking it?

5 |1600 characters needed characters left characters exceeded

Attachments: Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

question