5

I have a fairly simple batch file which does just one thing - "net start myservice". This batch file gets shortcut-ed in a program group by installer so that users can simply click on the icon and get things started (or stopped). All works well in XP for the users with admin rights. But things get hairy on Win7 as the batch need to be run "as administrator" explicitly and often users don't know this. So my question is how to make this friendly? Telling users to right click and run as admin on Win7 and simply click on XP is kind of weird twist. I need a smart automatic simple thingy.

I could probably use "runas/user:administrator" in the batch itself, but this "administrator" account might not be available on some machines. I'm looking for a universal solution for installing things like this on any Windows box.

Ideas? How would you do this?

1
  • The Administrator account will be available on all systems, but indeed it could be locked or renamed. However, runas would be the proper thing to do, without compromising security. runas also is a shell verb that can be used instead of open in ShellExecute. Mar 3, 2011 at 1:15

3 Answers 3

3

Download the Elevation PowerToys for Windows from Microsoft. You can then include scripts in your install process so that you can run from the batch file elevate net start servicename and it will give them a UAC elevation prompt. As long as the user has administrative privileges on the computer or can get an administator to perform the elevation for them, it will run the command with elevated privileges and should work just fine. No need to specify a username or anything. There is a whole section in that article about creating a script that can detect if it is running with a sufficient access level, and if not, elevating itself.

0
2

Change the permissions of the myservice service to allow it to be started by ordinary users.


An easy way to do this is to use Process Explorer: start the service, double-click on its process in ProcExp, open the Services tab, and use the Permissions button.

(Process Explorer)

(ProcExp: Properties - Services)


The hard way:

C:\>sc sdshow Schedule

D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPLOCRRC;;;PU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SY)

The text displayed is a Security Descriptor String. Each (...) element is an ACE string.

For example, appending this to the SD would allow Users to control the service:

(A;;GX;;;BU)

BU is the SID string for Built-in Users group. For most purposes, granting GX (GENERIC_EXECUTE) should be enough.

Note: The "rights" in the ACE string don't seem to correspond in any obvious way to actual permissions given. For example, "Start service" is RP (READ_PROPERTY) and "Stop service" is WP (WRITE_PROPERTY).

3
  • This isn't exactly what I was asking for. The question was "what should be in the batch file" or "what should installer program do" in order to allow end user to control the service we deliver. As to myself, I'm a technical guy, I can twitch security stuff. The question is how to spare this wizardry from casual user and let him click and be happy.
    – Dima
    Jan 22, 2011 at 20:37
  • @Dima: SetServiceObjectSecurity(), of course... Or SetNamedSecurityInfo(), which seems to be a newer replacement for the former. Jan 22, 2011 at 20:38
  • Since Windows 2000 one can use ConvertStringSecurityDescriptorToSecurityDescriptor to convert the string format into the binary format that can be used by the aforementioned functions. I'm not entirely sure, though, that granting those permissions is a good idea. It opens a window into the TCB, after all ... Mar 3, 2011 at 1:19
0

Check out PsTools, it contains an app called psservice.exe, to start a service, it uses the following command line:

psservice.exe [\\Computer [-u Username [-p Password]]] start <svc>

If this will be run by restriced users, then you may want to wrap the batch file in an exe to prevent users from seeing the admin password.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .