.

Windows Service Permissions

<<

venom77

User avatar

Hero Member
Hero Member

Posts: 1905

Joined: Mon Dec 11, 2006 3:23 pm

Post Mon Jan 25, 2010 12:19 pm

Windows Service Permissions

Okay, so I have an odd scenario (odd to me at least). If I understand correctly, we have a server here that had the security permissions of a service changed to 'Everyone - Deny' to disallow anyone from touching it and anything from starting it. The service no longer shows up in services management, or anywhere else for that matter, and I have no way to do anything with it. I've been looking around but haven't had much luck finding an answer.

The closest solution I found was something that could revert ALL services back to their default permissions by applying a special template. That's not something I want to do (plus I'm not convinced it'll work).

Has anyone ever seen anything like this? Any ideas on how I can get access to this service?

Thanks!
<<

hayabusa

User avatar

Hero Member
Hero Member

Posts: 1661

Joined: Mon Jan 29, 2007 2:59 pm

Post Mon Jan 25, 2010 12:46 pm

Re: Windows Service Permissions

Top of my head, no, but if you have another 'similar' server, you could essentially try to use sc.exe from a command-line on this server (http://support.microsoft.com/kb/251192) and try to kill and recreate the service.  Might even be able to do it from safemode.  Only other thought I'd have would be to boot to a linux cd / dvd (http://www.pcregedit.com/) and find / manipulate the key from there, since Linux doesn't really CARE about windows permissions, much!  <evil grin>

::)
~ hayabusa ~ 

"All men can see these tactics whereby I conquer, but what none can see is the strategy out of which victory is evolved." - Sun Tzu, 'The Art of War'


OSCE, OSCP , GPEN, C|EH
<<

bamed

Newbie
Newbie

Posts: 48

Joined: Thu Mar 19, 2009 7:05 pm

Location: Joplin, MO

Post Mon Jan 25, 2010 1:40 pm

Re: Windows Service Permissions

Are you saying you changed the permissions of the actual executable file or the account the service ran as?  Maybe I'm wrong here, but I didn't think you could actually change permissions from the Services management, only change the account the service runs as.  So I'm assuming the file permissions of the executable were changed.  So you just need to find the location of the executable file and change them back.  If you don't know the name/location of the executable you could look for the service in the Registry under HKLM\SYSTEM\CurrentControlSet\services

Also, if you're still haveing trouble, let us know what server version (may not need this) and more importantly what service we're talking about.
chown -R bamed ./base
<<

venom77

User avatar

Hero Member
Hero Member

Posts: 1905

Joined: Mon Dec 11, 2006 3:23 pm

Post Mon Jan 25, 2010 2:21 pm

Re: Windows Service Permissions

Thanks for the replies.

I have tried sc with no luck, just get an 'access denied' error.

No, I'm talking about the permissions of the service (as in, pull in a new security template, edit the service to be 'disabled' and then change it to a have permissions of 'everyone - deny').

This is on Server 2003 and it is the Windows Time service (w32time). When you look in services, it's not even there. And any other attempts I've made have just resulted in 'access denied.' I did try changing the security value within the registry to match one of the other services but this didn't appear to work either (unless a reboot is needed?).
<<

Ketchup

User avatar

Hero Member
Hero Member

Posts: 1021

Joined: Fri Jul 04, 2008 7:44 pm

Location: Philadelphia, PA

Post Mon Jan 25, 2010 2:37 pm

Re: Windows Service Permissions

Bill, anytime you adjust services through the registry, a reboot is required.  Services get put in a pending stage. 
~~~~~~~~~~~~~~
Ketchup
<<

venom77

User avatar

Hero Member
Hero Member

Posts: 1905

Joined: Mon Dec 11, 2006 3:23 pm

Post Mon Jan 25, 2010 2:45 pm

Re: Windows Service Permissions

Okay, thanks. I will give that another shot when I get a chance to see if it actually works then.

I did find that resetting security permissions via this command did the trick on a test box:

  Code:
secedit /configure /cfg %windir%\repair\secsetup.inf /db secsetup.sdb /verbose


I just have to do some further testing/checking to see what all else it changes. The services isn't too big a deal since I can just go back in and re-apply the template I already have.
<<

Ketchup

User avatar

Hero Member
Hero Member

Posts: 1021

Joined: Fri Jul 04, 2008 7:44 pm

Location: Philadelphia, PA

Post Mon Jan 25, 2010 3:08 pm

Re: Windows Service Permissions

Is it possible that the registry key itself (for the w32time) service has incorrect permissions? 
~~~~~~~~~~~~~~
Ketchup
<<

venom77

User avatar

Hero Member
Hero Member

Posts: 1905

Joined: Mon Dec 11, 2006 3:23 pm

Post Mon Jan 25, 2010 3:37 pm

Re: Windows Service Permissions

I suppose it's possible - but I was told that it was locked out via the security analysis/configuration snap-in. I just happened to notice that the security key with the security entry had a value that was different from the other services. I thought maybe by changing that value to match the others it would magically show up :)

The command I referenced above works, but it pulls back in the 'setup security' (out of the box settings). Which is good that it works, but requires a whole lot of reconfigurations to get things back to how they should be. I'm working on going through that template right now to compare to the current settings (minus the w32time permissions). If I can figure it all out I'll just create a new template, do the reset and then apply my template to bring all the settings back to how they should be.

Luckily, this isn't causing any problems for the moment so I've got some time. It was done originally to sync the time with a phone switch instead of the network due to the application running on it. Apparently group policy was re-enabling w32time after the admins were disabling it and it was causing issues with their app so removing all permissions was the way to fix it I guess.
<<

hayabusa

User avatar

Hero Member
Hero Member

Posts: 1661

Joined: Mon Jan 29, 2007 2:59 pm

Post Mon Jan 25, 2010 5:39 pm

Re: Windows Service Permissions

Personally, I'd still try the reboot, and see if the registry change does the job.  As Ketchup said, service changes in the registry tend to require reboot.

Keep us posted, BillV.
~ hayabusa ~ 

"All men can see these tactics whereby I conquer, but what none can see is the strategy out of which victory is evolved." - Sun Tzu, 'The Art of War'


OSCE, OSCP , GPEN, C|EH
<<

venom77

User avatar

Hero Member
Hero Member

Posts: 1905

Joined: Mon Dec 11, 2006 3:23 pm

Post Tue Jan 26, 2010 7:02 am

Re: Windows Service Permissions

Beautiful!

That was it. Had the right registry key - HKLM\SYSTEM\CurrentControlSet\Services\W32Time\Security - it just needed to be rebooted after making that change. It worked on my test box anyway, just gotta wait for an opportunity to reboot this server and make sure it works there too (I'm sure it will).

Sweet :) Thanks guys!
<<

hayabusa

User avatar

Hero Member
Hero Member

Posts: 1661

Joined: Mon Jan 29, 2007 2:59 pm

Post Tue Jan 26, 2010 8:55 am

Re: Windows Service Permissions

That's what we're here for!  Glad it worked BillV.  Sometimes, MS makes things easier than you think, if you just have a little insight and some spare time...

Have a great day!
~ hayabusa ~ 

"All men can see these tactics whereby I conquer, but what none can see is the strategy out of which victory is evolved." - Sun Tzu, 'The Art of War'


OSCE, OSCP , GPEN, C|EH

Return to Other

Who is online

Users browsing this forum: No registered users and 2 guests

.
Powered by phpBB® Forum Software © phpBB Group.
Designed by ST Software