I need to grant a specific account SERVICE_START permissions for a given Windows service.

There seems to be some methods for doing so here, but would prefer a method that's native to PowerShell and doesn't require external tools, for ex. by using Get/Set-ACL cmdlets, or calling some .NET API.

Does someone know how to do it in that fashion? Thanks in advance.


There isn't a .NET native base class for this. Microsoft did a good job for providing a way to set permissions for files, directories, registry, and Active Directory groups/objects, but not this.

To do this in managed code, one needs to create a custom class derived from NativeObjectSecurity. This is true for services, printers, and anything else not covered by the framework-supplied classes. Not too difficult in C#.

| improve this answer | |
  • Thanks Greg. As much as valid your approach, I'm trying to find a way that requires no additional assembly installed in the target server. I'm experimenting now with WMI Win32_Service class and Get/SetSecurityDescriptor methods (which in turn are giving me some other headaches :-) – Ariel Jun 30 '10 at 13:08
  • 2
    Yes, anything that uses SDDL, such as the sc command, will only allow you to replace the entire security descriptor. Reading the existing security descriptor and attempting to determine which entries to insert/remove are quite tedious. – Greg Askew Jun 30 '10 at 13:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.