Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to grant a specific account SERVICE_START permissions for a given Windows service.

There seems to be some methods for doing so here, but would prefer a method that's native to PowerShell and doesn't require external tools, for ex. by using Get/Set-ACL cmdlets, or calling some .NET API.

Does someone know how to do it in that fashion? Thanks in advance.

share|improve this question

There isn't a .NET native base class for this. Microsoft did a good job for providing a way to set permissions for files, directories, registry, and Active Directory groups/objects, but not this.

To do this in managed code, one needs to create a custom class derived from NativeObjectSecurity. This is true for services, printers, and anything else not covered by the framework-supplied classes. Not too difficult in C#.

share|improve this answer
Thanks Greg. As much as valid your approach, I'm trying to find a way that requires no additional assembly installed in the target server. I'm experimenting now with WMI Win32_Service class and Get/SetSecurityDescriptor methods (which in turn are giving me some other headaches :-) – Ariel Jun 30 '10 at 13:08
Yes, anything that uses SDDL, such as the sc command, will only allow you to replace the entire security descriptor. Reading the existing security descriptor and attempting to determine which entries to insert/remove are quite tedious. – Greg Askew Jun 30 '10 at 13:37

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.