Remote service query (sc.exe query) fails with "access is denied" for one service, but not others

Question

I'm trying to remotely uninstall a specific service, but get the famous "FAILED 5: Access is denied." message. I've reduced the test case to running

sc \\remotemachine.domain.local query "flexnet licensing service"

and I get

[SC] EnumQueryServicesStatus:OpenService FAILED 5:
Access is denied.

The interesting thing is that I can remotely query pretty much any other service from the same client and there's no problem. The host machine

• Has UAC disabled
• Has LocalAccountTokenFilterPolicy set to 1

Using the same user when logged on directly to the machine, I can query, start or stop this "flexnet licensing service" with no problem, it's only when trying to do it remotely than I encounter a problem.

Originally we bumped into this problem when our uninstaller could not uninstall this service, using the Windows C API. The uninstaller would work fine when run directly on the machine, but when invoked remotely via WMI it would fail. We've been reducing the test case progressively, and so far in all cases, querying or trying to stop or delete this particular service fails when attempted remotely.

I have also tried calling a batch script remotely, which contained the commands:

powershell.exe -Command "Start-process C:\myDeleteSvc.exe -Verb RunAs"

Where myDeleteSvc.exe was a simple program installed on the target machine to delete the service using the Windows C API, but that also failed in the OpenService call with an access denied. Again, it works fine if run directly on the machine.

I've had this happen with the service installed on Windows 7 and 2008R2 machines (did not test on other platforms).

The service in question is for a third party software. It has a dependency on the Windows Management Instrumentation service, but even when I manually remove all dependencies (and dependents) it still cannot be queried remotely.

Does anyone have any further suggestions for investigation (or solutions)?

There is one case where the service can be uninstalled remotely. We talked to the support team for this product in trying to understand the problem, and while they're also mystified, they did provide a msi file that, when run remotely, uninstalled the service in question. We don't have access to whatever script was used to generate this msi, but we were told it was "very simple, and all it did was uninstall the service". One possible avenue of investigation is to understand if the msi service uninstall does anything "extra" when it performs an uninstall--does anyone know?

Some related questions, although they seem to all be the same theme of UAC & running as administrator, and since I can query other services remotely, I think my problem must be something slightly different. Including the links makes the bot think this is spam, so just search on the titles.

• “Access is denied” when trying to start service even when running Administrator/elevated
• psexec: “Access is Denied”?
• remote sc OpenSCManager query failed 5 access denied

Answer 1

Thanks to Craig620, the problem was indeed related to the security descriptor.

C:>sc sdshow "flexnet licensing service"

D:(D;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;NU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCLCSWRPLOCRRC;;;IU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

C:>sc sdshow myService

D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

And from the SID syntax we can see the first entry ((D;;...;;;NU)) Disables most permissions for anything coming over the network (NU). When I changed the SD to have the same permissions minus the NU disablement, I could query and delete the service remotely using the sc.exe command.