Set access permissions for Windows services

Author: Beyond

By default, only members of the Administrators group, the LocalSystem, and the Power Users group have permission to start and stop services. In order for a normal user to be able to control the service, we can manually set its access rights. Maybe some beginners will feel strange, how can the service also set permissions? In fact, in the Windows system, not only can set permissions on the folder, but also the registry, printers and services, such as system resources to set permissions. However, there are two ways to set permissions on a service without having to set permissions on the folder:

Security Configuration and Analysis

(1) Log in to the system as Administrator, enter MMC in the Run dialog box and enter to open the console window, and then add the Security Configuration and Analysis snap-in.

(2) Right-click the newly added Security Configuration and Analysis snap-in, click the Open Database menu item on the pop-up menu, specify the new security database name in the dialog box that opens, for example, Srvacl, and then click the Open button.

(3) On the dialog box that opens, select the security template file that is built into the system, for example, you can select the Setup security template.

(4) Right-click the Security Configuration and Analysis snap-in, click the Analyze Computer now menu item on the pop-up menu, and click OK on the pop-up dialog box to begin analyzing the security configuration of the current computer.

(5) After the analysis, click the System Services node in the left-hand console tree and double-click the service name of the desired setting in the details pane on the right side (this example is app service).

(6) On the Open Properties dialog box, tick the Define this policy in database check box, and then click the Edit Security Settings button.

(7) On the Security Settings dialog box that opens, add the users user, and then make sure that the Allow check box to the right of the start stop and pause permission is checked, as shown below.

(8) Click OK on all open dialog boxes, then right-click the Security Configuration and Analysis snap-in, click the Configure Computer Now menu item on the pop-up menu to configure the system with the permission settings you just defined.

subinacl Command Tool

You can also use the SUBINACL command tool to easily view and set the permissions of the service configuration, to the following Microsoft official website download its latest version:

http://www.microsoft.com/downloads/details.aspx?FamilyId=E8BA3E56-D8FE-4A91-93CF-ED6985E3927B&displaylang=en

(1) Log on to the system as an administrator and open a command prompt window.

(2) at the command prompt, enter the following command:

Subinacl/service Appsrv/grant=users=top

Note that subinacl can only receive the service name (ServiceName) instead of the display name (DisplayName). The command parameter "Grant=users=top" indicates that the Users group account is granted the "Start, stop, and pause" appsrv service, and T in "top" represents the start (start) permission, O represents the Stop permission, and P stands for Pause (abort/Continue) permissions.

(3) Next, you can run the following command to view the permissions settings for the APPSRV service:

Subinacl/verbose=2/service Appsrv/display=dacl

The command results are similar to the following:

====================

+service Appsrv

====================

/perm. Ace Count =5

/pace =builtin\administrators access_allowed_ace_type-0x0

Service_all_access

......

/pace =builtin\users access_allowed_ace_type-0x0

service_start-0x10 service_stop-0x20 service_pause_continue-0x40

Note the logon identity of the service specifies how much permissions the service can have to access system resources, and the access rights of the service specify how much permissions the user can take to control the service.

http://caizhixin75.blog.163.com/blog/static/1835107120071171136765/

Set access permissions for Windows services