Granting service control manager access permission to user outside of administrator group

Question

I have a user outside of administrator group. How can I grant service control manager access permission for that (specific) user?

It's like SC_MANAGER_ALL_ACCESS from the following link:

http://msdn.microsoft.com/en-us/library/windows/desktop/ms685981%28v=vs.85%29.aspx

Solution

Try the sc.exe with sdset command. It uses sddl format and I'm not sure if you can implement your needs exactly as you want. See the article Understanding the SDDL permissions in the ACE_String to convert to sddl format.

Comments

[Harry Johnston]

You might have to write a program (using the OpenSCManager and SetServiceObjectSecurity functions). Keep in mind that if you do this the user will be able to give himself administrator access if he or she wants to.

[Pavel Radzivilovsky]

Users of administrator group are able to do that. Which exactly of the settings of the administrator group triggers that?

[Artyom]

Have you seen this: stackoverflow.com/questions/3279392/… may be it can help

[Harry Johnston]

@PavelRadzivilovsky: the service control manager has an ACL which, by default, explicitly grants full access to the Administrators group.

[Pavel Radzivilovsky]

Bwah, I didn't know there can be such a thing.. By the way, blogs.msdn.com/b/distributedservices/archive/2009/03/13/…

[Scott Pack]

Welcome to Server Fault! Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference.

[Harry Johnston]

Specifically, use sc sdset SCMANAGER as described here (but with a different SDDL string, of course): support.microsoft.com/kb/907460