Windows: Set permissions on a service
when it is necessary that normal user needs the ability to do some operations on a service, such as starting or stopping, multiple ways exists to grant these permissions. Windows has no GUI or (easy to use) command line tool on board to set these access rights. I will show you 3 ways to set them.
- Sysinternals Process Explorer
- sc.exe (Service controller)
- subinacl.exe (The security swiss knife)
For the following examples I will use the OpenVPN Service with its Service Name openvpnservice and assign the start and stop permissions to a user or group. But its the same procedure for all other services.
The easiest way is to use the sysinternals Process Explorer. It provides a graphical user interface but has the dependency that the service must be in the running state before process explorer is started. If you already have a valid openvpn configuration start the service:
sc start openvpnservice
Then start the process explorer as administrator and locate the openvpn service process openvpnserv.exe.
Right click, choose properties from the menu and select the service tab.
Press the permissions button and open the advanced settings. You can grant the various permissions to every User or Group. For example the start/stop/restart rights for the BuiltIn Users Group.
The permissions can also granted at command line with sc.exe (Service Controller) or the subinacl.exe (Command line ACL editor) . sc.exe is on board since Windows Vista , subinacl is part of the resource kit for Windows Server 2003 and is only available in a 32Bit version but already works for Windows Vista/7/8/8.1.
With sc.exe you have to edit or set the acls in sddl format. The sdshow option prints out the current persmissions. Editing the sddl is difficult but possible. See MSDN.
C:\>sc sdshow openvpnservice
There is an easy way to get an valid sddl string :-). Open a management console mmc.exe and add the snapin “Security Templates”.
Create a new Template
Locate the service
Name it “OpenVPN Service Permissions”
Define Startup Mode
save the template and open the inf file, in my case the file C:\Users\loadm\Documents\Security\Templates\OpenVPN Service Permissions.inf. This should contains something like that:
[Service General Setting]
Note: The template editor does not set the permissions itself, it only builts a inf file which can be imported by secedit. But we only need the sddl string:-)
This sddl string can be set by the sc.exe command:
sc.exe sdset openvpnservice D:AR(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;RPWPDTRC;;;BU)S:AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
[SC] SetServiceObjectSecurity SUCCESS
The 3rd way is to use subinacl.exe. This tool must be downloaded at microsoft. When downloaded, install the msi package.
msiexec /i subinacl.msi
You only have to install it one times. Than copy the subinacl.exe file to the hosts on which you want to use it.
The advantage against sc.exe is that you can modify an existing set of permissions.First of all ensure you have the correct version of subinacl.exe. The original version from the resource kit has many bugs. Check the version. This is the correct one.
SubInAcl version 5.2.3790.1180
This shows the currently defined permissions on the openvpnservice
D:\tmp>subinacl /service openvpnservice
======================== +Service openvpnservice ======================== /control=0x0 /owner =system /primary group =system /audit ace count =1 /aace =everyone SYSTEM_AUDIT_ACE_TYPE-0x2 FAILED_ACCESS_ACE_FLAG-0x80 FAILED_ACCESS_ACE_FLAG-0x0x80 SERVICE_ALL_ACCESS /perm. ace count =4 /pace =system ACCESS_ALLOWED_ACE_TYPE-0x0 SERVICE_ALL_ACCESS /pace =builtin\administrators ACCESS_ALLOWED_ACE_TYPE-0x0 SERVICE_ALL_ACCESS /pace =interactive ACCESS_ALLOWED_ACE_TYPE-0x0 SERVICE_QUERY_CONFIG-0x1 SERVICE_QUERY_STATUS-0x4 SERVICE_ENUMERATE_DEPEND-0x8 SERVICE_INTERROGATE-0x80 READ_CONTROL-0x20000 SERVICE_USER_DEFINED_CONTROL-0x0100 /pace =builtin\users ACCESS_ALLOWED_ACE_TYPE-0x0 SERVICE_START-0x10 SERVICE_STOP-0x20 SERVICE_PAUSE_CONTINUE-0x40 READ_CONTROL-0x20000 Elapsed Time: 00 00:00:00 Done: 1, Modified 0, Failed 0, Syntax errors 0 Last Done : openvpnservice
You can get the full help text of subinacl with
subinacl /help /full
This command line adds the builtin Users group and grants the Query Service Configuration,Query Service Status,Start Service, Stop Service, Pause, Continue Service rights:
subinacl /service openvpnservice /grant=Users=QSTOP
Possible rights are
F : Full Control
R : Generic Read
W : Generic Write
X : Generic eXecute
L : Read controL
Q : Query Service Configuration
S : Query Service Status
E : Enumerate Dependent Services
C : Service Change Configuration
T : Start Service
O : Stop Service
P : Pause/Continue Service
I : Interrogate Service
U : Service User-Defined Control Commands