How to Configure Windows Service Permissions

[W]

First, has any third party come up with a human friendly tool to let the
admin configure permissions for each service running on a Windows system? I
understand in theory that the SC command can set descriptors, but the
descriptor language is not for human beings. At very least it requires too
much time to study the descriptors.

I have an application that has a service permission of:

Administrators: full control
Interactive: read
System: full control

Without understanding the descriptors, I was told that this corresponds to
the command:

SC sdset <servicename>
D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSW
LOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)

Instead I want this to become:

Administrators: full control
Users: read, start, stop, and pause
System: full control

What is the correct SC command and descriptor to use for the above?

Please note the computer is not a member server in a domain. So I cannot
use GPO.

[Special Access]

Post by W
First, has any third party come up with a human friendly tool to let the
admin configure permissions for each service running on a Windows system? I
understand in theory that the SC command can set descriptors, but the
descriptor language is not for human beings. At very least it requires too
much time to study the descriptors.
Administrators: full control
Interactive: read
System: full control
Without understanding the descriptors, I was told that this corresponds to
SC sdset <servicename>
D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSW
LOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)
Administrators: full control
Users: read, start, stop, and pause
System: full control
What is the correct SC command and descriptor to use for the above?
Please note the computer is not a member server in a domain. So I cannot
use GPO.

maybe you can't use GPO, but you can use the "Security configuration
and analysis snap-in" for the MMC console, where you can set security
permissions on any service on the computer.

Mike

[W]

Post by W

Post by W
First, has any third party come up with a human friendly tool to let the
admin configure permissions for each service running on a Windows system?

I

Post by W

Post by W
understand in theory that the SC command can set descriptors, but the
descriptor language is not for human beings. At very least it requires too
much time to study the descriptors.
Administrators: full control
Interactive: read
System: full control
Without understanding the descriptors, I was told that this corresponds to
SC sdset <servicename>

D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCS

W

Post by W

Post by W
LOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)
Administrators: full control
Users: read, start, stop, and pause
System: full control
What is the correct SC command and descriptor to use for the above?
Please note the computer is not a member server in a domain. So I cannot
use GPO.

maybe you can't use GPO, but you can use the "Security configuration
and analysis snap-in" for the MMC console, where you can set security
permissions on any service on the computer.

Just what the doctor ordered, thanks.