---
title: Advance Policy for Windows Services
slug: kronpam-agent-reference-guide-3-9-0/advance-policy-for-windows-services
createdAt: 2023-11-08T17:03:41.762Z
---

Windows services can be policed via Kron PAM. Local admin users can be restricted, or normal users can have rights on the Windows services that require administrator privileges. Policies can be written for a single user or user group over an agent or agent group. 

- To do that, go to the **Services **section of the **Advanced Policy Screen**. 
- Click the **Add **button.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/m4kbLTJBT7x72iV5t5w2U_image.png "Figure- Advance Service Policy Config")

- Give a name for your Service Policy and choose the user or user group.

::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/_MXaRtN29uklytryR9ri2_image.png" size="74" width="984" height="711" position="center" caption="Advance Service Policy Config" darkWidth="984" darkHeight="711" showCaption="true"}

:::hint{type="info"}
Service rule can be enabled or disabled. When it is disabled rule will be reverted.
:::

- Select the agent, agent groups, or device group. 

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/iYO12ZA7HXeGr7hzKLBzE_image.png "Advance Service Policy Config")

- Choose the policy according to needs. If a user is a local administrator, you can restrict their rights with remove + allow or add + deny. If the user isn't a local administrator, you can give rights with add + allow or remove + deny. Each type is supported.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/Qj2K-mYR_vu5RUW9KFXfL_image.png "Advance Service Policy Config")

- Lastly, you need to choose the service name from the drop-down menu and save the configuration.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/fGcLWQO3fAjOjAeoEjxW7_image.png "Advance Service Policy Config")

:::hint{type="info"}
\* While giving rights to Windows Services, sometimes we can have errors due to Windows default Service permissions. We may not apply to given rights on Windows Services. Please check the detailed logs.
:::

### Adding Multiple Applications to an Advanced Policy

An advanced policy applies to one or more applications. To add another application to the same policy, click **Add Application** on the **APPLICATION INFO** step. Each application appears in its own **Application Info** section. To remove an application, click the delete icon next to its section.

![](https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/llIsm2z9nB1TYx5-D7mw1_image.png "Figure – Adding two applications to an advanced policy")

The policy action applies to every application in the policy. In the following example, an advanced policy blocks the *mspaint.exe* and *notepad++.exe* applications. When a user starts either application, the agent blocks it and displays the **Access Denied!** message:

::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/8GPkxEoHKqRXcVMyV3M0D_image.png" size="60" caption="Figure – Access Denied message for the mspaint application" isUploading="false" width="860" height="311" darkWidth="860" darkHeight="311" showCaption="true" alt="ouch..."}

::Image[]{src="https://api.archbee.com/api/optimize/g9cApVza9NIhSh0pjZYtA/IfeC4h0oKUGn3mnuWNAn3_image.png" size="60" caption="Figure – Access Denied message for the notepad++ application[" isUploading="false" width="1093" height="389" darkWidth="1093" darkHeight="389" showCaption="true"}