If you implement Group Policy at the Default Domain Policy, the policy takes effect on all computers in the domain. If you implement Group Policy at the Default Domain Controllers policy, the policy only applies to the servers in the domain controller's organizational unit (OU). You can create OUs that contain workstations for which policies can be applied. This article describes the steps to implement a Group Policy on a OU to change permissions on system services.
- Start Active Directory Users and Computers.
- Right-click the domain in which you want to add the OU, click New, and then click Organizational Unit.
- Give the OU an appropriate name, and then click OK. The new OU is listed below the domain.
- Right-click the new OU, and then click Properties.
- The OU properties are now displayed. On the Group Policy tab, click New. Give the new Group Policy an appropriate name (for example, the name of the OU for which it is implemented).
- After the policy is created, make sure it is highlighted, and then click Edit.
- Click Computer Configuration, click Windows Settings, click Security Settings, and then click System Services.
- Double-click the service on which you want to apply permissions. The security policy setting for that specific service is displayed.
- Click to select the Define this Policy Setting check box. This action automatically creates security permissions with Everyone having Full Control.
- Click Remove to remove the Everyone group.
- Click Add to add the System account and any other user accounts to which you want to grant access.
- Set the permission for the System account at Full Control, as well as the appropriate permissions for user accounts or groups. By default, only the start, stop, and pause permissions are granted to all new users.
- After you finish adding the appropriate users and groups with the appropriate permissions to the service, click OK.
- The service startup mode is set to disabled by default. Change this setting to the correct startup mode (usually automatic).
- Click OK, close the policy, and then click OK.
For additional information about system service permissions not being applied, click the article number below to view the article in the Microsoft Knowledge Base:
ID do Artigo: 256345 - Última Revisão: 16/12/2009 - Revisão: 1