I have a user outside of administrator group. How can I grant service control manager access permission for that (specific) user?

It's like SC_MANAGER_ALL_ACCESS from the following link:


  • You might have to write a program (using the OpenSCManager and SetServiceObjectSecurity functions). Keep in mind that if you do this the user will be able to give himself administrator access if he or she wants to. – Harry Johnston Oct 22 '12 at 23:26
  • Users of administrator group are able to do that. Which exactly of the settings of the administrator group triggers that? – Pavel Radzivilovsky Oct 23 '12 at 8:29
  • Have you seen this: stackoverflow.com/questions/3279392/… may be it can help – Artyom Oct 23 '12 at 9:52
  • @PavelRadzivilovsky: the service control manager has an ACL which, by default, explicitly grants full access to the Administrators group. – Harry Johnston Oct 23 '12 at 18:27
  • Bwah, I didn't know there can be such a thing.. By the way, blogs.msdn.com/b/distributedservices/archive/2009/03/13/… – Pavel Radzivilovsky Oct 24 '12 at 8:10

Try the sc.exe with sdset command. It uses sddl format and I'm not sure if you can implement your needs exactly as you want. See the article Understanding the SDDL permissions in the ACE_String to convert to sddl format.

| improve this answer | |
  • 2
    Welcome to Server Fault! Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. – Scott Pack Oct 23 '12 at 14:19
  • 1
    Specifically, use sc sdset SCMANAGER as described here (but with a different SDDL string, of course): support.microsoft.com/kb/907460 – Harry Johnston Oct 23 '12 at 18:29

Take a backup of the existing permissions:

sc sdshow scmanager


Replace the SID with the AD group or AD user's SID

sc sdset scmanager D:(A;;0xF003F;;;S-1-5-21-3674034044-3586052758-1582440453-1121)(A;;CC;;;AU)(A;;CCLCRPRC;;;IU)(A;;CCLCRPRC;;;SU)(A;;CCLCRPWPRC;;;SY)(A;;KA;;;BA)S:(AU;FA;KA;;;WD)(AU;OIIOFA;GA;;;WD)
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.