Allow non-administrator users to start and stop Codar service on Windows

When running Codar on Windows, by default, only users with administrator privileges can start or stop the Codar services. This procedure explains how to grant permissions to non-administrator users to start and stop these services. This process involves the following tasks:

• Create a non-administrator user account, if one does not exist.

• Determine the security identifier (SID) of the non-administrator user.

• Set the security descriptor for the services to allow the non-administrator user to start and stop them.

• Add necessary permissions to the Codar installation directory for the non-administrator user.

Allow non-administrator users to start and stop Codar service

To allow non-administrator users to start and stop the Codar service, complete the following steps:

1. Start the Control Panel on the Codar system and click Add or remove user accounts that is under User Accounts.

2. Click Create a new account in the Manage Accounts window that appears.

3. Enter a name for the user, select the Standard user radio button if it is not selected, and then click the Create Account button to create the user account.

   In this procedure we will use the user account name "CODARUser."

4. Open a command prompt window and run the following command, as is applicable, to display the security descriptor for the Codar service:

   sc sdshow codar

   The command returns a security descriptor in Security Descriptor Definition Language (SDDL), like the following example for the Codar service:

   D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;;CCLCSWLOCRRC;;;SU)S:
(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

5. Copy the security descriptor that was returned by the above command to a text editor such as Notepad.

6. Run the following command to display the names and SIDs for all existing user accounts:

   wmic useraccount get name,sid

7. From the command output, copy the SID for the non-administrator user to the text editor.

   The SID is usually in a format like S-1-5-21-3637136161-1358011849-3560387905-1014.

8. Add (A;;RPWPCR;;;<SID of non-admin user>) before the S:(AU;... portion of the security descriptor that you copied to a text editor earlier in this procedure.

   Using the security descriptor and SID from our example, the result would be as follows, with the added text shown against a gray background:

   D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;;CCLCSWLOCRRC;;;SU)(A;;RPWPCR;;;S-1-5-21-3637136161-1358011849-3560387905-1014)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

9. Run the following command, as is applicable, to set the security descriptor for the Codar service to the new value:

   -sc sdset codar "<new security descriptor>"

   This message [SC] SetServiceObjectSecurity SUCCESS is returned if the command completes successfully.

Add permissions to the Codar directory for non-administrator user

The non-administrator user now has the permissions necessary to start and stop the Codar service. As a test, you can log in using the non-administrator user account and start and stop the Codar service.

The final steps below will add necessary permissions to the Codar directory for the non-administrator user.

To add permissions to the Codar directory for the non-administrator user, complete the following steps:

1. Log into the Codar machine as administrator.

2. In Windows Explorer, navigate to the Codar installation directory (for example, C:\Program Files\HPE\Codar), right-click on the folder, and select Properties in the menu that appears to open the Codar Properties dialog box.

3. Click the Security tab in the Codar Properties dialog box.

4. Check if the user is listed in the Group or user names list in the dialog box, and if it is not listed, continue with the next step. If the user is listed, go to Step 7 to continue.

5. Click the Edit... button, click the Add... button in the dialog box that appears, enter the non-administrator user name in the Enter the object names to select field, and then click the Check Names button.

6. Select the name, and then click OK to add the user to the Group or user names list.

7. Select the user name, select the Allow check box for the following permissions, and then click OK.

   • Read &execute

   • List folder contents

   • Read

   • Write