0

I want to remotely stop / start / restart SQlBrowser service from a .net core 6 application running on IIS that uses the Powershell 7 library.

The application pool of the .net core service runs under a domain user, called domain.local\service-mgr-svc.

If I make domain.local\service-mgr-svc local administrator on the remote SQL Server, that I want to control the sqlbrowser service on, the remote invoke command works:

Invoke-Command -ComputerName sql-svr.domain.local -Scriptblock { restart-service -Name "sqlbrowser" }

When I take the user out of local administrator group, I get the following error

Cannot find any service with the service name "SQL Browser"

If I try just "get-service", I get response about "might need elevated permissions"

My question is, what are those permissions? I've been down the rabbit-hole on this.

What I have tried:

GPO to give the user on the remote server;

  • "Log on as Service"
  • "Act as operating system"
  • "Log on as batch job"

Giving the user the following permissions on the Root Namespace in the WMI config;

  • Execute Methods
  • Remote Enable
  • Read Security
  • Enable Account

Alas, it does not work. What can I try next?

1 Answer 1

0

(Posting the solution on behalf of the question author in order to move it to the answer space).

So I had a look at this SubInACL.exe stuff and that did the job!

I noticed that running cmd on the remote server and trying to stop / start SQLBrowser, I got access denied.

So did a

dir>.\SubInACL.exe /service SQLBrowser /grant=domain\user=PTOIS

And it works!

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.