0

I have an executable installing a service that I want to run on my server.

It is working as expected while Run as administrator. However I don't want to give it the control over the whole server. I would rather limit its permissions to whats necessary only.

I used Process Explorer to find out what DLLs are executed when app works in the admin mode. These were generic libraries from C:\Windows\system32, C:\Windows\SysWOW64 and C:\Windows\Globalizaion that are accessible to custom app's user anyway.

I have given the app's custom user Full control permissions to all the location it uses that I know of.

Is there a way to check for locations/permissions app is using? Do you have any other ideas?

Unfortunetely the program's provider isn`t as helpful as one would expect.

Improve this question
4
  • What is needing the administrative rights? the installer for the service or the service itself? Because registering a service needs administrative rights because it need to write to HKLM\SYSTEM\CurrentControlSet\Services which needs admin permissions
    – Auge
    Jan 14, 2021 at 12:11
  • @Auge running the service requires admin rights.
    – Rico
    Jan 14, 2021 at 14:56
  • Well then without knowing which service you need to run I can only speculate. Have you checked the Privilege flags with process explorer in the properties of the app? some of those need elevated permissions. Another thing can be that your app need write access to some restricted registry keys. You could try using something like App-V to sequence your app and have a look what files and keys will be touched
    – Auge
    Jan 14, 2021 at 15:18
  • @Auge I need to run a custom service delivered by a third party. Thank you for your suggestions. I've tried giving a dedicated user all the permissions available in local policy group. I have also granted him SC_MANAGER_ALL_ACCESS. The App-V is a terific idea, I have no idea how to use it with windows service though.
    – Rico
    Jan 15, 2021 at 13:17

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .