In Windows (10 specifically) why can a user stop or start a service via services.msc but if attempting to do this via cmd require an elevated shell?

As the title suggests. I had a user who has rights to open services.msc and can start/stop/edit the services with no issue via the GUI.

User cannot script the starting of a service (e.g. "net start SERVICENAME") however because it requires an elevated admin cmd to run these commands. I was just wondering how to explain this behavior?

I don't know if this is unique to Windows 10 but I am not able to try other releases.

Solution 1:

Most likely, Services.msc is actually running elevated/as an administrator. By default on Windows 7 and later, users who are local administrators only see elevation prompts for programs outside a Windows-controlled allowed list; programs on the allowed list, which I believe does include Services.msc, will be auto-elevated without any prompt.

You can check this by creating a local user who isn't an administrator and seeing if you can launch Services as that user without entering an administrator's username and password.