Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 4 down vote favorite
1

I have a user outside of administrator group. How can I grant service control manager access permission for that (specific) user?

It's like SC_MANAGER_ALL_ACCESS from the following link:

http://msdn.microsoft.com/en-us/library/windows/desktop/ms685981%28v=vs.85%29.aspx

share|improve this question
You might have to write a program (using the OpenSCManager and SetServiceObjectSecurity functions). Keep in mind that if you do this the user will be able to give himself administrator access if he or she wants to. – Harry Johnston Oct 22 '12 at 23:26
Users of administrator group are able to do that. Which exactly of the settings of the administrator group triggers that? – Pavel Radzivilovsky Oct 23 '12 at 8:29
Have you seen this: stackoverflow.com/questions/3279392/… may be it can help – Artyom Oct 23 '12 at 9:52
@PavelRadzivilovsky: the service control manager has an ACL which, by default, explicitly grants full access to the Administrators group. – Harry Johnston Oct 23 '12 at 18:27
Bwah, I didn't know there can be such a thing.. By the way, blogs.msdn.com/b/distributedservices/archive/2009/03/13/… – Pavel Radzivilovsky Oct 24 '12 at 8:10

1 Answer

up vote 1 down vote

Try the sc.exe with sdset command. It uses sddl format and I'm not sure if you can implement your needs exactly as you want. See the article Understanding the SDDL permissions in the ACE_String to convert to sddl format.

share|improve this answer
1  
Welcome to Server Fault! Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. – Scott Pack Oct 23 '12 at 14:19
Specifically, use sc sdset SCMANAGER as described here (but with a different SDDL string, of course): support.microsoft.com/kb/907460 – Harry Johnston Oct 23 '12 at 18:29

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.