Section 6: Service Permissions

The Big Picture: Two Different Questions

Section 5 asked: "What can the service do?" (its account). This section asks the opposite question: "What can people do to the service?" Who may start it? Who may stop it? Who may change its settings?

Think of the hotel again. The cleaner's key (Section 5) decides which rooms the cleaner can enter. But a separate rule decides who is allowed to tell the cleaner to start or stop work. Only managers should.

     Section 5                          Section 6
  SERVICE  ──acts on──►  system       PEOPLE ──act on──► SERVICE
  (its account)                       (its permissions)

6.1 Who Can Start/Stop/Configure a Service

What it is: Every service is a protected object. Windows attaches to it a security descriptor, a small record that says who may do what. Inside is a list called the DACL (Discretionary Access Control List). Each line in the list is an ACE (Access Control Entry): "this user or group is allowed (or denied) these actions".

The actions (rights) on a service:

Typical defaults for a normal Windows service:

This is why a normal user can open services.msc and read it, but gets "Access is denied" (error 5) when trying to stop most services. To change services you open the tool as administrator.

See a service's permissions in a safe way (read-only):

sc sdshow Spooler

You get an odd-looking line called SDDL (Security Descriptor Definition Language), like:

D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)

(Your output may differ a little.) How to read it:

You do not have to memorise the codes. The skill to learn: find the WHO letters and see which rights each one has. If BA has long rights and IU has few, only admins can change it.

Warning: sc sdset changes these permissions. A wrong value can lock everyone out of a service, including you. In this course, only read with sdshow.

Why would anyone change them? Sometimes an administrator wants a non-admin helper to restart one particular service (for example, a web server) without giving them full admin rights. They add one ACE for that user with just "start" and "stop".

Who else is checked? The SCM checks permissions on every request (Section 2.3). That includes services.msc, sc, PowerShell and any program using the SCM API.

6.2 Service SIDs

What it is: A SID (Security Identifier) is a unique code that Windows uses to name a user, group or object inside permission lists. A service SID is a SID created for one particular service. It lets you say "give this service only access to this folder".

How it is made. The SID is generated from the service name (a repeatable calculation, so the same name always gives the same SID). It looks like S-1-5-80-... and can also be written as NT SERVICE\<ServiceName>.

Why it is useful:

 Both run as LocalService                With service SIDs
┌──────────┐  ┌──────────┐             ┌──────────┐  ┌──────────┐
│ Service A│  │ Service B│             │ Service A│  │ Service B│
└────┬─────┘  └────┬─────┘             └────┬─────┘  └────┬─────┘
     │ same badge  │                        │ NT SERVICE\A│ NT SERVICE\B
     └──────┬──────┘                        ▼             ▼
            ▼                          Folder A       Folder B
    both can open both folders        each opens only its own

See the SID type of a service (read-only):

sc qsidtype Spooler

The types are:

Virtual accounts and service SIDs. A virtual account (Section 5.4, NT SERVICE\<name>) uses the same name as the service SID. They go hand in hand.

Real-world analogy: each worker gets their own coloured wristband in addition to the shared company badge. Doors can be set to open only for one wristband.

6.3 Service Hardening (Windows 10+ Restrictions)

What it is: Hardening means making something harder to attack. Over the years (starting with Windows Vista and strongly in Windows 10 and 11) Microsoft added extra walls around services, so a bug in one service does less damage.

The main hardening steps:

What "privilege" means here. A privilege is a special power such as "load a driver", "debug other programs" or "shut down the system". The more a service has, the more a bug can be abused. Required-privilege lists strip away powers the service never uses.

See required privileges (read-only):

sc qprivs Spooler

You get a list such as SeChangeNotifyPrivilege, SeImpersonatePrivilege, and so on. (Exact lists differ by service.)

What this means for you:

• A service may be unable to write somewhere even though its account looks powerful. A restricted token is the likely reason.
• Do not "fix" a failing service by giving its account full control of a folder. Add the service SID with just the rights needed.
• Services cannot show windows to the logged-in user (Session 0). A service that "needs a screen" should use a separate helper app in the user's session.

Summary