Administrator User on Windows 2008 R2 server gets "access denied" messages for starting/stopping services

Question

I logged into a Windows 2008 R2 server as a domain user that is part of the Administrators group on the target computer. Executing the following command, I get access is denied errors:

$> sc stop ServiceName
[SC] OpenService FAILED 5:
Access is denied.

What is strange is, as the very same user, I can open up the Services GUI (Administrative Tools > Services) and start/stop the very same service no problem. This appears to be happening for all services that I try to start/stop, and it happens as any "Administrative" user on this computer (with the exception of the local admin user, which I don't have the creds for in order to test). Command line fails, but GUI works.

I also know that spelling of the service name is correct, because if I alter it to be something else, I get a different error ("The specified service does not exist..."). I do notice that I can change the casing of the service name (ServiceName vs SERVICENAME) and get access denied errors on both.

I get similar access denied messages when using "net start ServiceName" instead of the sc command.

Any idea what is going on here? Needing this to work for scripting purposes. The same scripts are working fine on a Win2003 server.

Solution

Looks like you have discovered why lots of people hate User Account Control.

You should right-click on the Command Prompt icon and select "Run As Administrator"; that will allow you to actually make use of your admin rights.

Comments

[Matt]

Problem is .... I'm trying to script this for remote execution (with psexec) from TeamCity

[Massimo]

Then have a look at riosec.com/Windows-UAC-PsExec.

[Massimo]

Or just disable UAC on the remote system altogether. I've found "when something doesn't work, disable UAC" to be pure wisdom.

[Matt]

-h did the trick for me (as suggested in the linked article). Thank you kind sir!!

[Massimo]

BTW, you don't need PSEXEC to remotely control a service; sc allows you to connect to a remote machine using the syntax sc \\<servername> stop <servicename>.

[Matt]

Thanks. I use psexec because I'm executing the command as a specific user, and could not use RUNAS because I could not provide the password inline.

[Michael Haephrati]

It happened to me even though I ran CMD as Administrator