Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need to grant a specific account SERVICE_START permissions for a given Windows service.

There seems to be some methods for doing so here, but would prefer a method that's native to PowerShell and doesn't require external tools, for ex. by using Get/Set-ACL cmdlets, or calling some .NET API.

Does someone know how to do it in that fashion? Thanks in advance.

share|improve this question
add comment

1 Answer

There isn't a .NET native base class for this. Microsoft did a good job for providing a way to set permissions for files, directories, registry, and Active Directory groups/objects, but not this.

To do this in managed code, one needs to create a custom class derived from NativeObjectSecurity. This is true for services, printers, and anything else not covered by the framework-supplied classes. Not too difficult in C#.

share|improve this answer
    
Thanks Greg. As much as valid your approach, I'm trying to find a way that requires no additional assembly installed in the target server. I'm experimenting now with WMI Win32_Service class and Get/SetSecurityDescriptor methods (which in turn are giving me some other headaches :-) –  Ariel Jun 30 '10 at 13:08
1  
Yes, anything that uses SDDL, such as the sc command, will only allow you to replace the entire security descriptor. Reading the existing security descriptor and attempting to determine which entries to insert/remove are quite tedious. –  Greg Askew Jun 30 '10 at 13:37
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.