Is it possible to use Group Policy to grant the permission to manage Windows services?

You can definitely use Group Policy to grant users rights to start / stop services. You just need to modify the security descriptor on the service using the "Security" group policy client side extension.

A very slight caveat: I have seen cases where some services don't like the default permission that a group policy-based modification puts on a service (look at this posting about the Windows Search service if you want to see what I'm talking about: http://peeved.org/blog/2007/12/07), but that has been uncommon in my experience.

In order to "see" the service in the Group Policy editor you'll need to do the editing on a computer that has the service installed. (If this is a stock Windows service then it's no big deal, but if it's something third-party get on a machine that has it installed, "runas" a copy of MMC, and snap-in a Group Policy editor targeted at the GPO where you want to put these settings.)

Under "Computer Settings", "Windows Settings", "Security Settings", and "System Services", locate the service you want to grant start / stop permission to and define a policy setting. You have to choose a startup type. Click "Edit Security" and modify the default ACL to include the permissions you're looking for.

I'd recommend testing the GPO on a constrained group of computers (either by linking the GPO to a test OU with a single computer, or by filtering the GPO to only a single computer) and making sure it does what you want before you go changing the security on all your computers only to find out it doesn't do what you want.

Here's some background on what the various entries in an ACE mean for services:

• http://support.microsoft.com/kb/914392
• http://msmvps.com/blogs/alunj/archive/2006/02/13/83472.aspx

To see the descriptors in SDDL notation, use the "sc sdshow service-name" command.

Edit:

Delegated permission to create new services is going to be a little bit tough. There is a "SC_MANAGER_CREATE_SERVICE" right that can be granted to users on the service control manager (SCM) object in the global object manager.

In Windows versions up to Windows Server 2003, the rights could not be changed on the SCM. Starting in W2K3 SP1, you could change the rights on the SCM.

The API to change the security is SetServiceObjectSecurity, and more information is available here: http://msdn.microsoft.com/en-us/library/aa379589(VS.85).aspx

Some more reference re: the rights that can be granted to the SCM and the default DACL set on the SCM is available here: http://msdn.microsoft.com/en-us/library/ms685981(VS.85).aspx

In short, there's no way to do this w/o writing code. There's no magic registry setting, etc. If you can get somebody to write the code for you, though, it's totally feasible.

Take a look at these knowledge base articles at Microsoft - How To Configure Group Policies to Set Security for System Services and How to grant users rights to manage services in Windows 2000 which discusses alternative methods of granting access to manage services.

Hope this helps.

The solution provided by Microsoft just covers Windows 2000 Systems, as they say at the bottom of the Article, even though the solution is valid for all of their OS.

How to Add Third-Party Services to the System Services in Group Policy

So it's a huge step back in its centralization idea for their Group Policy infrastructure released with Windows 2008 R2.

How to create the Central Store for Group Policy Administrative Template files in Windows Vista