Windows Service Permissions...

[Jason Richmeier]

The application I am currently working on contains a custom windows service.

On my machine, when I logon with a domain user (non-admin) account, the user
is unable to control (start and stop) the service (an access denied message
is displayed). On another machine, the same user is able to control this
service. This leads me to believe that this is being caused by one or more
permission settings (or lack of).

The first question...what permission settings do I need to give to a user
(non-admin) account to allow them to control this service?

The second question...is it possible to give the user permission to control
my custom service but to not control all other (system) services or is it an
all-or-nothing situation? I would like the user to be able to start and stop
the service that I created but not other system-type services.

Thank you,

Jason Richmeier

[John A. Bailo]

Jason Richmeier wrote:

The application I am currently working on contains a custom windows service. The first question...what permission settings do I need to give to a user
(non-admin) account to allow them to control this service?

The key question is what resources does the application(ser ver) use.

The service is basically an automated user -- who has same privileges as
the user account under which it runs.

If you need it to read a file, then the account it runs under needs to
have permission to read the file.

If it has to go out on the network, and grab files, then the account has
to have permission to access the network shares.

And so on....

[Jason Richmeier]

I apologize if the question was a little vague.

The service is running using the local system account so it has enough
permissions to do the work it needs to do. What I am really after is what
permissions does a user logged in to the machine that the service is running
on need to be able to start and stop the service using the service control
manager.

"John A. Bailo" wrote:

Jason Richmeier wrote:

The application I am currently working on contains a custom windows service.

The first question...what permission settings do I need to give to a user
(non-admin) account to allow them to control this service?

The key question is what resources does the application(ser ver) use.

The service is basically an automated user -- who has same privileges as
the user account under which it runs.

If you need it to read a file, then the account it runs under needs to
have permission to read the file.

If it has to go out on the network, and grab files, then the account has
to have permission to access the network shares.

And so on....

[Cerebrus]

Hi Jason,

I believe that running a Windows service with the Local System is
something that is not recommended at all, from a Security point of
view.

If you want the user to be able to interact with the service, you
should consider using a custom user account.

[Jason Richmeier]

I am not sure I completely understand your second point.

Regardless of the account I set the service to run under (set either when
the service is deployed and installed or through the service's properties),
the currently logged on user cannot start and stop my service (or any other
service for that matter) on my machine. If I install my service on another
machine, the same user logged on to that machine can start and stop my
service. This leads me to believe it is a local setting of some sort. I am
trying to figure out what settings I need to make to allow a user to start
and stop my service on my machine. Ideally, I would like for the user to be
able to start and stop my service only (so that they are not starting and
stopping critical system services).

Thank you,

Jason Richmeier

"Cerebrus" wrote:

Hi Jason,

I believe that running a Windows service with the Local System is
something that is not recommended at all, from a Security point of
view.

If you want the user to be able to interact with the service, you
should consider using a custom user account.

[Jeffrey Tan[MSFT]]

Hi Jason,

Thanks for your post!

The Service security and access right is documented in the MSDN link below:
"Service Security and Access Rights"
http://msdn.microsoft.com/library/de...us/dllproc/bas
e/service_securit y_and_access_ri ghts.asp

1. As we can see in the link: "Only processes with Administrator privileges
are able to open handles to the SCM that can be used by the CreateService
and LockServiceData base functions.", so only Administrators can create the
service.

2. The key point you are after is listed in the bottom of the MSDN link:
"The default security descriptor of a service object grants the following
access". As we can see, service object only grants SERVICE_START and
SERVICE_STOP permission to Administrators and LocalSystem accounts. Local
authenticated users (including LocalService and NetworkService) can only
have read permission over the service.

So the answer to your question is: only Administrators group or LocalSystem
account processes can manipulate the services installed on the machine.

Hope this helps

Best regards,
Jeffrey Tan
Microsoft Online Community Support
=============== =============== =============== =====
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
=============== =============== =============== =====
This posting is provided "AS IS" with no warranties, and confers no rights.