Make sure you have the latest version of Subinacl.exe (there is an older version that has a bug where it will not apply the security descriptor).
Documentation for Subinacl.exe is here: http://www.robvanderwoude.com/subinacl.php
If you are not using a domain user, you can create a local user on both servers that have the same user name and password. As long as the local user names and passwords match on both machines, you can remotely manage the services.
On the server that is running the service (SRVAPP in this example), grant the “shared” local account permissions to Start, Stop, Pause, Continue, and Query the service.
SharedAppUser is the local user name and Msvsmon80 is the short name for the service
subinacl /SERVICE msvsmon80 /GRANT=SharedAppUser=LQSTOP
For a domain user, the command would include the domain name:
subinacl /SERVICE msvsmon80 /GRANT=MYDOMAIN\SharedAppUser=LQSTOP
The complete list of service control options are as follows:
- F : Full Control
- R : Generic Read
- W : Generic Write
- X : Generic eXecute
- L : Read controL
- Q : Query Service Configuration
- S : Query Service Status
- E : Enumerate Dependent Services
- C : Service Change Configuration
- T : Start Service
- O : Stop Service
- P : Pause/Continue Service
- I : Interrogate Service
- U : Service User-Defined Control Commands
From the remote server, attempt to start and stop the service remotely from a command line under the security context of the “shared” local acccount:
sc \\SRVAPP start "msvsmon80"
sc \\SRVAPP stop "msvsmon80"