where does ServiceController gain its authority to start and stop services?

where does ServiceController gain its authority to start and stop services?

• Denis Voyer

  I was thinking this was how I'd have to approach it... I was hoping there was some easier way than to do that, but perhaps I can wrap it and make it more functional for my usage.
  
  thanks so much!
  

• KnutVG

  Your user authentication token is what dictates whether you can control services. If you want to impersonate another user (assuming you have privileges to impersonate users) you must use WindowsIdentity.Impersonate documented with a sample at http://msdn.microsoft.com/library/en-us/cpref/html/frlrfSystemSecurityPrincipalWindowsIdentityClassImpersonateTopic.asp to get an IIdentity, then pass that to the WindowsPrincipal constructor. The instance of WindowsPrincipal you just created you assign to Thread.CurrentPrincipal then instantiate your ServiceController on that thread with an impersonate user authentication token.
  
  A search for "ServiceController WindowsIdentity" yields a couple of good results. The one for ASP.NET uses the user identity of the page (meaning anonymous login is disabled so Internet Explorer and more recent versions of Firefox use NTLM to authenticate you on the server, assuming it's on the same domain) and impersonate you. The concept is the same.
  
  

• .neo

  I should also mention that this is a separate issue apart from requiring that the code be granted the ServiceControllerPermission with appropriate rights based on evidence for the executing code and code groups that would grant the permission. That's only code access security at work. Windows authorization ensures that the user authentication token for the thread calling methods on the ServiceController object have appropriate access to start, stop, or otherwise control services.
  
  

• BrianD65

  Without having to impersonate a user, how can I assign sufficient privilages to a user group so they can query the status/start/stop a service on a remote server
  
  Giving the user group administrator access on the remote server is not an option. Surely there is a way to assign just enough permissions to allow users to control a service without having to open up other resources on the server... This seems like a straight-forward thing to do but I can't find any information on how to do this.
  
  Thanks
  
  
  
  

• P. Weyrosta

  The MSDN topic at http://msdn2.microsoft.com/en-us/library/ms685981.aspx has more information about who is granted what rights, if those can be changed based on the platform, and how to change them if possible.
  
  

• Doug K

  From that article...
  
  "Notice that remote users authenticated over the network but not interactively logged on can only perform user-defined operations. To perform other operations, the user must be logged on interactively or the service must use one of the service accounts."
  
  Suck! Is there a way I can change the DACL using .Net natively (or perhaps some obscure admin screen within Windows) so remote users authenticated over the network CAN perform status query, start, and stop commands All those Win32 functions look incredibly nasty.
  
  
  
  
• where does ServiceController gain its authority to start and stop services?