I'm trying to write an application, that is running as a local user on the server, and needs access to enumerate services, and potentially even control them (start/stop).

Is being a part of the administrators group the only way this user would be able to get access to this functionality (being used via the ServiceController class)? If easier, I'd be ok with even just being able to enumerate the list of services (the interactive starting/stopping isn't a show-stopper). Would adding the user to the power user's group work?


edit: http://msdn.microsoft.com/en-us/library/windows/desktop/ms685981(v=vs.85).aspx#access_rights_for_the_service_control_manager


The Power Users group is never the answer. It's an old legacy thing. Best to just consider it non-existent.

If you want to set permissions on individual Windows services in a granular way, you can, but it's nowhere near as easy/intuitive as setting permissions on a file

To view the current permissions of a Windows service:

C:\Users\Ryan>sc sdshow netlogon


To set the permissions on a single Windows service, for example, so that a non-admin user can start and stop a particular service:

[SC] SetServiceObjectSecurity SUCCESS

That looks awful, doesn't it? That goo is called SDDL - Security Descriptor Definition Language.

This article is a pretty good primer on how to interpret SDDL and do what you're trying to do.

You can also use Security Templates and Group Policies to accomplish the same thing:

Security Template

| improve this answer | |
  • The subinacl commandline tool, available as a server 2003 reskit download, is also an option. It uses a not-quite-so-messy syntax to edit service permissions. I'll post a syntax for reference in tomorrow. – ErikE Nov 20 '13 at 3:51

Another friendly option for doing the same thing is the subinacl command line tool included in the Windows 2003 Resource Kit. It is a wonderful little bag of tricks.

Here is the syntax for setting user permissions on services:

SUBINACL /SERVICE \\MachineName\ServiceName /GRANT=[DomainName\]UserName[=Access]

These are the Access-options available:

F : Full Control
R : Generic Read
W : Generic Write
X : Generic eXecute
L : Read controL
Q : Query Service Configuration
S : Query Service Status
E : Enumerate Dependent Services
C : Service Change Configuration
T : Start Service
O : Stop Service
P : Pause/Continue Service
I : Interrogate Service 
U : Service User-Defined Control Commands

So to give the members of the group DOMAIN\GroupName permission to start and stop the service 'ServiceName' one would:

subinacl /service ServiceName /GRANT=DOMAIN\GroupName=TO

To view permissions set on the service 'ServiceName' (before and after running the above) one would:

subinacl.exe /service /verbose=1 ServiceName

Here is an official HOWTO for setting service permissions using subinacl: http://support.microsoft.com/kb/288129

And here is the subinacl download link: http://www.microsoft.com/en-us/download/details.aspx?id=23510

| improve this answer | |
  • Subinacl is at least more friendly that sc sdset. Have an upvote. – Ryan Ries Nov 20 '13 at 23:02
  • does it work on Server 2012 / 2012 R2, too? As far as i can see, Microsoft doesn't officially list it as compatible. – BatteryBackupUnit Feb 13 '15 at 8:31

To enumerate services, your process needs the SC_MANAGER_ENUMERATE_SERVICE right, in the old days every authenticated user had this right, but since Vista this is no longer the case.

Interactive users have it, that's why a normal user can do a net start or Get-Service

You can change the permissions on the Service Control Manager to allow your process to enumerate services. You also need to change permissions on any service you want to access.

I just wrote a blog post about how to do this, it includes a PowerShell script to do this for all services on the local machine.

| improve this answer | |

Hm, that all depends on the language you're using to query processes, but the required user role will be determined by a set of privileges that your code will need on the target machine. Some of those privileges are associated with normal user accounts whereas others will require admin role.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.