Windows. How do I disable users from modifying system services?

Source Address: http://community.csdn.net/Expert/topic/4933/4933221.xml? Temp =. 2227899.

Question:
I only want Members of the Administrator group to have the permission to start or stop the service (including pausing the service)

Answer:
Expand your registry. The service is usually located in the following three locations. Since you manually add the service, you should be clear about its location.
HKEY_LOCAL_MACHINE/system/CurrentControlSet/services

HKEY_LOCAL_MACHINE/system/controlset001/services

HKEY_LOCAL_MACHINE/system/controlset002/services

Expand and find the new one: item: Right-click the property permission to add a non-Admin System account, such as user1; user3. set their permissions to deny!

Tested:
Disable firewall in Environment XP SP2! Modify system service name: Messenger
First, set the system service to start: Manual
Send a message to the local device: net send 192.168.1.3 msg
Sent locally
Received locally

Modify registry
HKEY_LOCAL_MACHINE/system/CurrentControlSet/services
Set the sub-item "messnger" to administrator "Disable" full control
Send a message to the local device: net send 192.168.1.3 msg
Sent locally
Received locally

If you double-click the "messenger" service in services. MSC, the system prompts:
Configuration Manager: A required entry in the registry is lost or an attempt to write data to the Registry fails --> OK
Access denied --> OK

The above strength proves that the Administrator has no right to control the service, but the service can still provide services for the system and is still applied by the Administrator account!