1

I am on yet another obstacle. I have a non-admin IIS identity account, to which I would like to grant permission to start, stop, restart, and read the status of one Windows Service. I followed the solution posted here. However, I would like to achieve this via PowerShell to automate, because I have so many servers. I was able to get SID of non-admin account, and get the output of command and save it under a variable. I converted to string, but cannot apply any functions such as StartsWith, split, insert, etc. Here is my code:

#Getting the SID for non-admin ISS identity account
$objUser = New-Object System.Security.Principal.NTAccount("non-admin")
$strSID = $objUser.Translate([System.Security.Principal.SecurityIdentifier])
$sid = $strSID.Value
#output retuned = S-1-5-21-2103278432-2794320136-1883075150-1000

#Storing the output of cmd prompt
$cmd = cmd.exe /c "sc sdshow <Service_Name>"
$test = $cmd | Out-String
#output returned = D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

#Storing the value that needs to be inserted in $CMD
$str = "(A;;RPWPCR;;;$sid)"

I would like to insert $str just before "S:" in $test and I have been unsuccessful. I would like to achieve this by PowerShell and not SubInAcl. Any help would be appreciated. The final code should look like below:

sc sdset <SERVICE_NAME> "D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)($str)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"

1 Answer 1

0

Assuming that your $test variable contains D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD), you could do:

$sid = "S-1-5-21-2103278432-2794320136-1883075150-1000"
$test = "D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"
$str = "(A;;RPWPCR;;;$sid)"

$newstring = $test -replace "S:","$($str)S:"

$newstring

returns:

D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;RPWPCR;;;S-1-5-21-2103278432-2794320136-1883075150-1000)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
11
  • Thank you for the help @Cory Knutson. I had to replace $str = "(A;;RPWPCR;;;$sid)S:" because $str should be after S:. However, I am trying to execute the command by passing in variable and I am getting errors in executing the final command.
    – Sid
    Commented Oct 23, 2017 at 12:31
  • Update:Thank you for the help @Cory Knutson. I had to replace $str = "(A;;RPWPCR;;;$sid)S:" because $str should be after S:. However, I am trying to execute the command by passing in variable but this doesn't seem to grant permissions to the account. I am trying something like this $arg="sc sdset <Service_Name> $newString" and then Powershell -command "Start-Process 'cmd' -Verb RunAS -ArgumentList '/c $arg' "
    – Sid
    Commented Oct 23, 2017 at 13:41
  • What error do you get? Commented Oct 23, 2017 at 14:49
  • So, $args output is as follows sc sdset <Service_name> and on new line $newString shows up. When this happens, CMD throws an error "[sc] Access is denied 5:".However, When I run the command manually in single line of code then the permissions were granted.
    – Sid
    Commented Oct 23, 2017 at 14:59
  • Are you running the Powershell console that you are trying this from as elevated for UAC? Commented Oct 23, 2017 at 17:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .