473,320 Members | 1,990 Online
Bytes | Software Development & Data Engineering Community
Post Job

Home Posts Topics Members FAQ

Join Bytes to post your question to a community of 473,320 software developers and data experts.

Windows Service Permissions...

The application I am currently working on contains a custom windows service.

On my machine, when I logon with a domain user (non-admin) account, the user
is unable to control (start and stop) the service (an access denied message
is displayed). On another machine, the same user is able to control this
service. This leads me to believe that this is being caused by one or more
permission settings (or lack of).

The first question...what permission settings do I need to give to a user
(non-admin) account to allow them to control this service?

The second question...is it possible to give the user permission to control
my custom service but to not control all other (system) services or is it an
all-or-nothing situation? I would like the user to be able to start and stop
the service that I created but not other system-type services.

Thank you,

Jason Richmeier
May 15 '06 #1
5 8264
Jason Richmeier wrote:
The application I am currently working on contains a custom windows service. The first question...what permission settings do I need to give to a user
(non-admin) account to allow them to control this service?


The key question is what resources does the application(server) use.

The service is basically an automated user -- who has same privileges as
the user account under which it runs.

If you need it to read a file, then the account it runs under needs to
have permission to read the file.

If it has to go out on the network, and grab files, then the account has
to have permission to access the network shares.

And so on....
May 15 '06 #2
I apologize if the question was a little vague.

The service is running using the local system account so it has enough
permissions to do the work it needs to do. What I am really after is what
permissions does a user logged in to the machine that the service is running
on need to be able to start and stop the service using the service control
manager.

"John A. Bailo" wrote:
Jason Richmeier wrote:
The application I am currently working on contains a custom windows service.

The first question...what permission settings do I need to give to a user
(non-admin) account to allow them to control this service?


The key question is what resources does the application(server) use.

The service is basically an automated user -- who has same privileges as
the user account under which it runs.

If you need it to read a file, then the account it runs under needs to
have permission to read the file.

If it has to go out on the network, and grab files, then the account has
to have permission to access the network shares.

And so on....

May 16 '06 #3
Hi Jason,

I believe that running a Windows service with the Local System is
something that is not recommended at all, from a Security point of
view.

If you want the user to be able to interact with the service, you
should consider using a custom user account.

May 16 '06 #4
I am not sure I completely understand your second point.

Regardless of the account I set the service to run under (set either when
the service is deployed and installed or through the service's properties),
the currently logged on user cannot start and stop my service (or any other
service for that matter) on my machine. If I install my service on another
machine, the same user logged on to that machine can start and stop my
service. This leads me to believe it is a local setting of some sort. I am
trying to figure out what settings I need to make to allow a user to start
and stop my service on my machine. Ideally, I would like for the user to be
able to start and stop my service only (so that they are not starting and
stopping critical system services).

Thank you,

Jason Richmeier

"Cerebrus" wrote:
Hi Jason,

I believe that running a Windows service with the Local System is
something that is not recommended at all, from a Security point of
view.

If you want the user to be able to interact with the service, you
should consider using a custom user account.

May 16 '06 #5
Hi Jason,

Thanks for your post!

The Service security and access right is documented in the MSDN link below:
"Service Security and Access Rights"
http://msdn.microsoft.com/library/de...us/dllproc/bas
e/service_security_and_access_rights.asp

1. As we can see in the link: "Only processes with Administrator privileges
are able to open handles to the SCM that can be used by the CreateService
and LockServiceDatabase functions.", so only Administrators can create the
service.

2. The key point you are after is listed in the bottom of the MSDN link:
"The default security descriptor of a service object grants the following
access". As we can see, service object only grants SERVICE_START and
SERVICE_STOP permission to Administrators and LocalSystem accounts. Local
authenticated users (including LocalService and NetworkService) can only
have read permission over the service.

So the answer to your question is: only Administrators group or LocalSystem
account processes can manipulate the services installed on the machine.

Hope this helps

Best regards,
Jeffrey Tan
Microsoft Online Community Support
==================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
==================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

May 17 '06 #6

This thread has been closed and replies have been disabled. Please start a new discussion.

Similar topics

2
by: cd | last post by:
Is there a specific process or permissions that must be granted to get a .NET (framework 1.4) Window Service to run properly on a Windows 2003 Server? I built a Windows Service to start two local...
1
by: Simon Chester | last post by:
Hello! Can anyone help me with this problem?... I have developed an ASP.NET (version 1.1) application which I have deployed to a number of webservers. The web application works fine on Windows...
4
by: Bala | last post by:
Hi, After installing Win2K3 SP1, ASP.NET pages are not being rendered at all. I get a Access Denied error (BC31019: Unable to write to output file) OR a Page Cannot Be Displayed (PCBD) error...
10
by: Ger | last post by:
I am having problems using VB.Net's Management base object on a machine hosting Windows Server 2003. I am trying to set file permissions from a Windows Service. These files may be loacted on a...
27
by: pisquem | last post by:
I am building an windows service that is to be deployed on a windows server 2003 and I want to have activity written to the event log, I want its own log called ('CustomLog') Below is what I...
3
by: Tom | last post by:
Is it possible to access (Read via StreamReader) an external file from a Wndows service? I.E. In the OnStart method of the service, I need to go out and read a couple of external files (and these...
10
by: dermot | last post by:
I have wrriten a small windows service application in visual studio ..net 2003 which listens for incoming FTP files. These files would overwrite over time due to duplicate file names. However any...
3
by: Derek Hart | last post by:
As a newbie to Windows Service programming in VB.Net, I need some clarification. I am writing a Windows Service that works with SQL Server. It works fine as a console application, but when I run it...
41
by: pbd22 | last post by:
Hi. I know my windows service works when i run it in debug mode on my dev machine. It also works in release mode on my dev machine. But, when I move the service to a production server, it...
3
by: Matt Lowrance | last post by:
I'm hoping someone can give me a little guidance. I have written a simple Windows Service that goes out and scrapes a few web pages and updates some data in an access database. The service works...
0
by: DolphinDB | last post by:
The formulas of 101 quantitative trading alphas used by WorldQuant were presented in the paper 101 Formulaic Alphas. However, some formulas are complex, leading to challenges in calculation. Take...
1
isladogs
by: isladogs | last post by:
The next Access Europe meeting will be on Wednesday 6 Mar 2024 starting at 18:00 UK time (6PM UTC) and finishing at about 19:15 (7.15PM). In this month's session, we are pleased to welcome back...
0
by: Vimpel783 | last post by:
Hello! Guys, I found this code on the Internet, but I need to modify it a little. It works well, the problem is this: Data is sent from only one cell, in this case B5, but it is necessary that data...
0
by: jfyes | last post by:
As a hardware engineer, after seeing that CEIWEI recently released a new tool for Modbus RTU Over TCP/UDP filtering and monitoring, I actively went to its official website to take a look. It turned...
0
by: ArrayDB | last post by:
The error message I've encountered is; ERROR:root:Error generating model response: exception: access violation writing 0x0000000000005140, which seems to be indicative of an access violation...
0
by: CloudSolutions | last post by:
Introduction: For many beginners and individual users, requiring a credit card and email registration may pose a barrier when starting to use cloud servers. However, some cloud server providers now...
0
by: Defcon1945 | last post by:
I'm trying to learn Python using Pycharm but import shutil doesn't work
0
by: af34tf | last post by:
Hi Guys, I have a domain whose name is BytesLimited.com, and I want to sell it. Does anyone know about platforms that allow me to list my domain in auction for free. Thank you
0
by: Faith0G | last post by:
I am starting a new it consulting business and it's been a while since I setup a new website. Is wordpress still the best web based software for hosting a 5 page website? The webpages will be...

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.