1

I need to grant a specific account SERVICE_START permissions for a given Windows service.

There seems to be some methods for doing so here, but would prefer a method that's native to PowerShell and doesn't require external tools, for ex. by using Get/Set-ACL cmdlets, or calling some .NET API.

Does someone know how to do it in that fashion? Thanks in advance.

1 Answer 1

1

There isn't a .NET native base class for this. Microsoft did a good job for providing a way to set permissions for files, directories, registry, and Active Directory groups/objects, but not this.

To do this in managed code, one needs to create a custom class derived from NativeObjectSecurity. This is true for services, printers, and anything else not covered by the framework-supplied classes. Not too difficult in C#.

2
  • Thanks Greg. As much as valid your approach, I'm trying to find a way that requires no additional assembly installed in the target server. I'm experimenting now with WMI Win32_Service class and Get/SetSecurityDescriptor methods (which in turn are giving me some other headaches :-)
    – Ariel
    Jun 30, 2010 at 13:08
  • 2
    Yes, anything that uses SDDL, such as the sc command, will only allow you to replace the entire security descriptor. Reading the existing security descriptor and attempting to determine which entries to insert/remove are quite tedious.
    – Greg Askew
    Jun 30, 2010 at 13:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .