CSA used to prevent stopping services

[reinke]

I want CSA to prevent stopping services from someone who is remotly connected to the windows pc (e. g. via telnet, vnc or remote desktop). Means: Those user should not be able to stop / start / restart any servive (e. g. dns client or ciscoworks daemon manager).

Can someone gibe me an advice which kind of rule I have to use to get this target?

Thanks

Edgar

[nkhawaja]

how do you dfferentiate if a service being stopped via a vnc session or locally. that is the main question.

you can have rules to block vnc sessions at all, or you can have rules for service controls.

[reinke]

Is it possible to have a kind of shim which prevents services from beeing stopped anyway?

Thanks

Edgar

[jeffasher · Accepted solution]

CSA only has provisions for control of the agent service and CSA 4.5 appears to be no different.

If you are running Active Directory look at this link - http://www.winnetmag.com/Article/ArticleID/44684/44684.html

With a little modification to the steps in the article you can craft a Group Policy to control service start/stop of any service.