Allow Non-Administrator Users to Start and Stop the CSA, Marketplace Portal, or Global Search Service on Windows

By default, only users with administrator privileges can start or stop the CSA, Marketplace Portal, and global search services. This procedure explains how to grant permissions to non-administrator users to start and stop these services. This process involves the following tasks:

• Create a non-administrator user account, if one does not exist.

• Update the security descriptor of the services.

• Change the permissions of the CSA installation directory for the non-administrator user.

To allow non-administrator users to start and stop the CSA, Marketplace Portal, or global search service, do the following:

1. Create a non-administrator user account:

   1. Log in to the CSA system as administrator.

   2. Navigate to Start > Control Panel on the CSA system and click Add or remove user accounts that is under User Accounts.

   3. Click Create a new account in the Manage Accounts window.

   4. Enter a name for the user, select the Standard user radio button if it is not selected, and then click the Create Account button to create the user account.

2. Update the security descriptor of the services:

   1. Open a command prompt window and run the following command, as is applicable, to display the security descriptor for the CSA or HPE Marketplace Portal service:

      For the CSA service: sc sdshow csa

      For the HPE Marketplace Portal service: sc sdshow hpemarketplaceportal.exe

      For the global search services:

      • sc sdshow hpesearchservice.exe
      • sc sdshow elasticsearch-service-x64 or
        sc sdshow elasticsearch-service-x86

      The command returns a security descriptor in Security Descriptor Definition Language (SDDL), like the following example for the CSA service:

      D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

   2. Copy the security descriptor that was returned by the above command to a text editor such as Notepad.

   3. Run the following command to display the names and SIDs for all existing user accounts:

      wmic useraccount get name,sid

   4. From the command output, copy the SID for the non-administrator user to the text editor.

      The SID is usually in a format like S-1-5-21-3637136161-1358011849-3560387905-1014.

   5. Add (A;;RPWPCR;;;<SID of non-admin user>) before the S:(AU;... portion of the security descriptor that you copied to a text editor earlier in this procedure.

      Using the security descriptor and SID from our example, the result would be as follows, with the added text highlighted in grey:

      D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;;CCLCSWLOCRRC;;;SU)(A;;RPWPCR;;;S-1-5-21-3637136161-1358011849-3560387905-1014)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

   6. Run the following command, as is applicable, to set the security descriptor for the CSA or HPE Marketplace Portal service to the new value:

      For the CSA service: sc sdset csa "<new security descriptor>"

      For the HPE Marketplace Portal service:
      sc sdset hpemarketplaceportal.exe "<new security descriptor>"

      For the global search services:

      • sc sdset hpesearchservice.exe "<new security descriptor>"
      • sc sdset elasticsearch-service-x64 "<new security descriptor>" or
        sc sdset elasticsearch-service-x86 "<new security descriptor>"

      The message [SC] SetServiceObjectSecurity SUCCESS is returned if the command completes successfully.

   Repeat this step for each user who will be allowed to start and stop the services.

3. Change the permissions of the CSA installation directory:

   1. In Windows Explorer, navigate to the CSA installation directory (for example, C:\Program Files\HPE\CSA), right-click on the folder, and select Properties in the menu that appears to open the CSA Properties dialog box.

   2. Click the Security tab in the CSA Properties dialog box.

   3. Check if the user is listed in the Group or user names list in the dialog box, and if it is not listed, continue with the next step. If it is listed, go to Step f to continue.

   4. Click the Edit... button, click the Add... button in the dialog box that appears, enter the non-administrator user name in the Enter the object names to select field, and then click the Check Names button.

   5. Select the name, and then click OK to add the user to the Group or user names list.

   6. Select the user name, select the Allow checkbox for the following permissions, and then click OK.

      • Read &execute

      • List folder contents

      • Read

      • Write

Log in to the CSA system using the non-administrator user account and start and stop the CSA, Marketplace Portal, and global search services.