One workaround for not having the correct service display when you edit the security templates is to administer the security templates from a computer that has the appropriate services already installed. However, this can be a problem, depending on the physical location of the server and the privileges that you have on that computer.

Another solution is to install as many services as possible on your workstation that you use for administration purposes. Of course, this will work only for a subset of all of the services that can run on a server.

Yet another solution is to install a dedicated server for administering security templates and GPOs. You can install all of the services on this computer, giving you access to all of the services you need for creating and modifying the security templates and GPOs with regard to services.

Another solution to consider is to manually control the services using the raw security template files. This approach requires you to get a listing of all of the services and the correct syntax stored in the security template file.

You will not always have a computer available to you that has every service required to make changes to the security templates or GPOs. In this case, you can manually update the security template files with the syntax that is associated with your service. To do this, you must have a list of all services your company uses and the syntax associated with each service as it is stored in the security template.

To get this list of service syntax, you must go at least once to a computer that has each service installed on it. This will allow you to get the syntax from the saved security template after configuring the service. Because the syntax used to modify the service is stored in the .inf files on the local computer, you can quickly acquire this list of services. You can then quickly compile the list into a single file that can be referenced from any computer and manually inserted into any security template file as needed.

Here is a list of some common services and the syntax used when they are configured in a security template.

The X in each syntax listing is a numeric variable that depends on the startup mode that you configure for the service. There are three startup modes: Automatic, Manual, and Disabled. Each has a numeric value associated with it, which you must insert in place of the X for each service and startup type. The numeric values for the startup types are as follows:

The double quotes ("") following the numeric value will include any permissions that you establish from within the security template for the service. This syntax is complex and can take a long time to configure. In most cases, the service permissions are not set.

Once you know the service syntax and you know which security template it needs to be added to, your work is almost finished. All you need to do is open up the security template file using Notepad and insert the correct code for the service you want to control.

When you open up the security template in Notepad, you must find the [Service General Setting] section. If this section does not exist, you can just add it to the bottom of the current file text. If you want to ensure that the DNS, DHCP, and Certificate Services start automatically but you wanted the IIS Admin Service to start disabled, you can add the following code to the appropriate security template file:

[Service General Setting]
"DNS", 2, " "
"DHCPServer", 2, " "
"CertSvc", 2, " "
"IISADMIN", 4, " "