Grant access to non-admin user to start/stop services windows 7

Question

I have a windows service and a windows application.I want to start and stop this window service from my windows application with arguments.Here is what i have got to start the service

  foreach (ServiceController sc in ServiceController.GetServices())
            {
                if (sc.ServiceName == "serviceName")
                {
                    //service is found
                    using (ServiceController serviceController = new ServiceController("serviceName"))
                    {
                        string[] args = new string[1];
                        args[0] = "Myargument";
                        if (serviceController.Status == ServiceControllerStatus.Running) 
                        {

                        }
                        else { serviceController.Start(args); }

                }
            }

But it gives me cannot open service on computer '.' exception.I tried using app.manifest to force run as administrator but still it gives exception.I also tried this post here but exception is still there.Does any one know how to grant access to manage services in non-admin user in windows 7 ?

Answer 1

You can use SetServiceObjectSecurity or SetNamedSecurityInfo to change the permissions on a service.

I have some code that uses ConvertStringSecurityDescriptorToSecurityDescriptor to create a security descriptor to pass to SetServiceObjectSecurity . Given a security descriptor, you can use GetSecurityDescriptorDacl to get the DACL to pass to SetNamedSecurityInfo .

The SDDL string I used to create the security descriptor is as follows:

wchar_t sddl[] = L"D:"
  L"(A;;CCLCSWRPWPDTLOCRRC;;;SY)"           // default permissions for local system
  L"(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)"   // default permissions for administrators
  L"(A;;CCLCSWLOCRRC;;;AU)"                 // default permissions for authenticated users
  L"(A;;CCLCSWRPWPDTLOCRRC;;;PU)"           // default permissions for power users
  L"(A;;RP;;;IU)"                           // added permission: start service for interactive users
  ;

Of course this code will need to be run with elevated permissions. Typically you would set the permissions at the same time that you install the service.