up vote 2 down vote favorite
share [g+] share [fb]

I would like to know if Windows standard user can normally change service startup type and how to prevent it. A customer reports that on Windows 7 (64-bit) he was able to change startup type from Automatic to Disabled for services of our product, thus disabling the product. Could this be true and is it possible on a standard Windows 7 installation?

link|improve this question
feedback

3 Answers

up vote 2 down vote accepted

On a standard Windows 7 installation it is not possible. That user must have:

  • Elevated his privileges before performing that operation by inserting an administration password, or
  • Benefited from a disabled UAC, or
  • Unknowingly be using an account with administrative privileges, or
  • Have seen his rights and permissions roles changed in the Local group Policy Editor.
link|improve this answer
2  
Disabling the UAC would have no effect. It only affects whether Windows 7 would ask if you want to run certain programs at an elevated level. He would still be limited by his given permissions, which are probably unknowingly administrative, which is really why he could make the change. I just tested the same account below after turning off UAC and rebooting, and the same: Grayed out. – KCotreau Jul 25 '11 at 11:33
Thank you for the answer. I wonder though, does disabling UAC really affect standard users, too? – Kaitnieks Jul 25 '11 at 11:35
Yes, if coupled with other situations like operating under a administrative account. That is, if you unknowingly have an administrator account and UAC is not disabled you will still get a warning. – A Dwarf Jul 25 '11 at 11:40
feedback
up vote 2 down vote

I just logged into a Windows 7 test machine as a standard user, and the options to change it are grayed out. I suspect he has more rights than he realizes, even if not an administrator.

enter image description here

link|improve this answer
feedback
up vote 1 down vote

Each Windows service has an ACL attached (just like files or registry keys do). By default, the ACL only allows modifications to Administrators, but it's possible to have it changed to allow certain operations to any user. It's unlikely that this is the case, though – service ACLs are hidden in a rather inconvenient place.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.