Greetings. Trying to have a VCron job perform some service operations on a remote server. The job fails with Access Denied. Account is able to restart services on machines in question. My company only assigns rights as specifically needed. What rights does an account need to perform remote service restarts from VCron? Looking for specifics. Please don't say full admin 🙂

You can use Group Policy Preferences to configure a service failure action. In the GPMC GPO editor go to [Computer Configuration > Preferences > Control Panel Settings > Services]. Create a new service with the same name of the service you wish to configure. Then go to the Recovery tab and select your failure actions (eg "Restart Service")


From:
https://superuser.com/qu...ific-service-if-it-stops 

So, the user that will be performing the restart will need to be added to the server (local or domain user) then you will have to set a GPO to allow for them to restart that specific service. You will need to add that credential to your visualcron client that is running the job.

Thank you for the suggestion. The service though isn't crashing. It just needs to be manipulated for some operations. Account is a domain account with rights to restart service. Credential is in VCron matching. I can log on locally and perform the service restart with the account VCron is using. Doing so through VCron gives the Access Denied error. I need to know the specific rights required. I could play around all day, but I need approval to turn certain ones on. Not very efficient.
I'm looking for things like:
Allow log on locally
Log on as a service
Log on as a batch
Allow remote login
etc.
Or another way would be what's the minimum rights a domain account needs to perform this operation?

two things come to mind...if you can log on locally then the credential in VisualCron should be like this:



That would be your user account literally logging in and acting as that user with all of its profile elements loading. That should really be the end of it.

If that does not work I would test using PsExec from sysinternals. The issue may not be the user it might be VC itself.

From your remote computer (not using visualcron) open a command prompt and use this command

psexec \\server -u username -p password net start ServiceName

psexec is an executable found here:
https://download.sysinte...es/SysinternalsSuite.zip 
Documentation found here: https://docs.microsoft.c...loads/sysinternals-suite 

\\server would = the server you are trying to control
-u = username (you may need domain\username)
-p = the password for the remote user
net start is the command to start a service
or
net stop if you need to stop
for testing I would do a 'net stop' to test. Net start would start it back up. There is no 'net restart' that I know of
ServiceName is the name of the service - make sure you are using the right service name. There are usually two names associated with services.

For VisualCron the two names are identical


for other services the names may differ

In this case the service name you would use in the command line is lmhosts

IF the psexec command run works then the issue is NOT on the server where the service is located and the user rights are good. If the command does not work then I would look more towards something like this: http://woshub.com/set-pe...ions-on-windows-service/ 

Thank you Joey,

Are you still having issues with this after Joeys suggestion, Dexter?

---