Granting permissions to log on as a service

You can grant permission to log on as a service to a specific device or to all devices in a domain. The "Log on as a service" permission allows you to start a process using an account that has been granted this permission.

Before granting the permission, make sure that the accounts or devices to which you want to grant the Log on as a service permission are not listed in the properties of the Deny log on as a service policy.

To grant the "Log on as a service" permission to a device:

1. Open the Run window by pressing the key combination Win+R.
2. In the opened window, type secpol.msc and click OK.

   The Local security policy window opens.

3. In the Local Security Policy window, go to the Security Settings → Local Policies → User Rights Assignment section.
4. In the pane on the right, double-click to open the properties of the Log on as a service policy.
5. This opens the Properties: Log on as a Service window; in that window, click Add User or Group.

   This opens the Select Users or Groups window.

6. In the Enter the object names to select (examples) field, list the names of the accounts or devices to which you want to grant the permission to log on as a service. Click OK.

To grant the "Log on as a service" permission to devices in a domain:

1. Open the Run window by pressing the key combination Win+R.
2. In the opened window, type gpedit.msc and click OK.

   The Local Group Policy Editor window opens.

3. Select Computer configuration → Windows configuration → Security settings → Local policies → User rights assignment.
4. In the pane on the right, double-click to open the properties of the Log on as a service policy.
5. This opens the Properties: Log on as a Service window; in that window, click Add User or Group.

   This opens the Select Users or Groups window.

6. In the Enter the object names to select (examples) field, list the names of the users or devices to which you want to grant the permission to log on as a service. Click OK.