Starting the Operations Center with non privileged account on Windows

You can use the non-privileged account to start or stop the Operations Center service on Windows.

1. As an administrator, create a new user with the name opscenter. Do not add it in Administrators group.
2. Open the Administrator Command Line console.
3. As an administrator, get security descriptor id (sid) of the user opscenter:

   wmic useraccount where name='opscenter' get sid

   output:

   S-1-5-21-YZYZYZYZYZ-XYXYXYXYXYXY-XZXZXZXZXZXZX-1002

4. As an administrator, add the sid from previous step to the access control entry (ACE) as following :

   (A;;RPWPCR;;;<sid>)

   1. A is for allowing various permission mentioned in ACE.

   2. RP represents Read Permission, permitting to read the object's security descriptor.

   3. WP represents Write Permission, permitting to modify the object's security descriptor.

   4. CR represents Control Permissions, permitting to change ownership, which includes rights to modify or delete the object.

   5. The resulting ACE in current example looks like:

      A;;RPWPCR;;;S-1-5-21-YZYZYZYZYZ-XYXYXYXYXYXY-XZXZXZXZXZXZX-1002)

5. As an administrator, get existing Security Descriptor Definition Language (SDDL) for Operations Center service : sc sdshow <SERVICE_NAME>

   sc sdshow “IBM Storage Protect Operations Center

   output:

   D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLC SWRPWPDTLOCRSDRCWDWO;;;WD)

   1. D represents the Discretionary Access Control List (DACL), which specifies who is allowed or denied access to the object.

   2. S represents the System Access Control List (SACL), which defines auditing rules for the object.

   3. Insert the ACE obtained from previous step in to DACL section of SDDL.

   4. The resulting SDDL (DACE and SACL ) looks like:

      D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;RPWPCR;;;S-1-5-21-YZYZYZYZYZ-XYXYXYXYXYXY-XZXZXZXZXZXZX-1002)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD). 

6. As an administrator, use the final DACL and SACL obtained from previous step for setting desired security descriptor (command sc sdset) for the operations center service as following:

   sc sdset "IBM Storage Protect Operations Center" "D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;RPWPCR;;;S-1-5-21-543652947-2383888226-3926862946-1002)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

   The command should result in success as following:

   [SC] SetServiceObjectSecurity SUCCESS

7. Logout from the Administrator account.
8. Log in as opscenter

   1. Open Service console.

   2. Look for the service IBM Storage Protect Operations Center.

   3. Start / Stop this service.