Windows Services Security
-
I have zonealarm installed and of course everyone knows, the vsmon services is basically the brains behind the outfit...anyways when I look at the services applet and go to options on vsmon almost everything is grayed out...so I went into the registry at hkey_local_machine\system\currentcontrolset\services\vsmon\security And in there, is a key called Security...It is a binary key and has a whole bunch of hex written in it. I imagine this is what is causing the services applet in XP to gray out all the configuration for it. Is there a way I can find out how to write my own Security reg keys like this for other services to keep people from tampering, etc? P.S. I've already "googled" the matter lol but maybe someone knows the answer elsewhere. Thanks in advance.
-
I have zonealarm installed and of course everyone knows, the vsmon services is basically the brains behind the outfit...anyways when I look at the services applet and go to options on vsmon almost everything is grayed out...so I went into the registry at hkey_local_machine\system\currentcontrolset\services\vsmon\security And in there, is a key called Security...It is a binary key and has a whole bunch of hex written in it. I imagine this is what is causing the services applet in XP to gray out all the configuration for it. Is there a way I can find out how to write my own Security reg keys like this for other services to keep people from tampering, etc? P.S. I've already "googled" the matter lol but maybe someone knows the answer elsewhere. Thanks in advance.
It's the Access Control List for the service object. You can view the ACL for a service using the
sctool:C:\>sc sdshow w3svc
D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)
(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)
(A;;CCLCSWLOCRRC;;;AU)
(A;;CCLCSWRPWPDTLOCRRC;;;PU)This output is in Security Descriptor Definition Language [SDDL] format. To set the ACL on a service from code, use
SetServiceObjectSecurity. From the command line, you can usesc sdset. Stability. What an interesting concept. -- Chris Maunder