{"id":19520,"date":"2020-10-25T14:28:28","date_gmt":"2020-10-25T14:28:28","guid":{"rendered":"http:\/\/198.58.113.91\/blog\/?p=19520"},"modified":"2021-05-07T11:23:23","modified_gmt":"2021-05-07T05:53:23","slug":"view-edit-service-permissions-windows","status":"publish","type":"post","link":"https:\/\/www.winhelponline.com\/blog\/view-edit-service-permissions-windows\/","title":{"rendered":"How to View and Modify Service Permissions in Windows"},"content":{"rendered":"<p><em><strong>Summary:<\/strong> This article explains the various methods to view the permissions for any Service in Windows. It also covers the tools and methods to modify the service permissions easily.<\/em><\/p>\n<p>Just as file system objects and registry keys have permissions, each service in Windows can have a set of permissions. The permission entries for a service determine who can stop the service, query its status, change the startup type, modify the service configuration, or <a href=\"https:\/\/www.winhelponline.com\/blog\/how-to-remove-unwanted-service\/\">delete the service<\/a>.<\/p>\n<p>You may have observed that the Start, Stop, and the Startup type controls are <a href=\"https:\/\/www.winhelponline.com\/blog\/task-scheduler-service-grayed-out-windows\/\">grayed out<\/a> for some services, even when you&#8217;re logged in as an administrator.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-medium\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2008\/03\/schedule-grayed.png\" alt=\"task scheduler service grayed out options\" width=\"431\" height=\"493\" \/><\/p>\n<div class=\"rp\"><strong>RELATED:<\/strong> <a href=\"https:\/\/www.winhelponline.com\/blog\/windows-update-service-properties-are-grayed-out-in-services-mmc\/\">Windows Update Service Properties Grayed Out in Services MMC<\/a><\/div>\n<p>And if you attempt to stop the Task Scheduler service from admin Command Prompt, you&#8217;ll get the following error message:<\/p>\n<pre class=\"err\">System error 5 has occurred.\r\n\r\nAccess is denied<\/pre>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-19522\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/10\/stop-service-error-5.png\" alt=\"service stop error 5 - view and edit service permissions\" width=\"699\" height=\"206\" \/><\/p>\n<p>This is because the Task Scheduler service permissions are pre-configured such that even the administrators can&#8217;t control this particular service.<\/p>\n<p>In this article, we&#8217;ll see how to view service permissions and modify them if needed.<\/p>\n<p><!--more--><\/p>\n<div id=\"toc\">\n<h3>Contents<\/h3>\n<ol>\n<li>View service permissions\n<ul>\n<li><a href=\"#sc_sdshow\">Method 1: Using the built-in SC.exe command<\/a><\/li>\n<li><a href=\"#accesschk\">Method 2: Using AccessChk from Sysinternals<\/a><\/li>\n<li><a href=\"#psservice\">Method 3: Using PsService from Sysinternals<\/a><\/li>\n<li><a href=\"#setacl\">Method 4: Using SetACL.exe from HelgeKlein<\/a><\/li>\n<\/ul>\n<\/li>\n<li>Modify service permissions\n<ul>\n<li><a href=\"#sc_sdset\">Method 1: Using the built-in SC.exe command<\/a><\/li>\n<li><a href=\"#procexp\">Method 2: Using Process Explorer from Sysinternals<\/a><\/li>\n<li><a href=\"#sse_tool\">Method 3: Using Service Security Editor<\/a> (third-party\/easiest method.)<\/li>\n<li><a href=\"#setacl_modify\">Method 4: Using SetACL.exe<\/a><\/li>\n<\/ul>\n<\/li>\n<\/ol>\n<p><strong>Editor&#8217;s choice:<\/strong> PsService &amp; Service Security Editor.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-6338 alignleft\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2018\/07\/icotip.gif\" alt=\"tips bulb icon\" width=\"34\" height=\"34\" \/>The built-in <code>SC.exe<\/code> command\/method requires you to first understand the SDDL format before you can interpret or modify the service permissions. You don&#8217;t need to know the complicated SDDL language if you follow the other methods.<\/p>\n<\/div>\n<div class=\"qt\">\n<h3>Important<\/h3>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignleft wp-image-9189\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2016\/08\/information-icon.png\" alt=\"\" width=\"48\" height=\"48\" \/>The permissions levels of the built-in services (e.g., Task Scheduler) are <strong>not meant<\/strong> to be modified arbitrarily by the user. Task Scheduler service has been used as an example in this article to illustrate how the service permissions can be viewed and modified.<\/p>\n<p>However, you can use this information to configure a custom or 3rd party service as per your requirements &#8212; e.g., to allow non-admin users to Start or Stop a Service.<\/p>\n<\/div>\n<h2>How to View the Service Permissions<\/h2>\n<p>There are many tools available to query the service permissions in Windows. Let&#8217;s see some of the methods.<\/p>\n<h3><a id=\"sc_sdshow\"><\/a>Method 1: Using SC.EXE SDSHOW command-line<\/h3>\n<p>To view the permissions for a Service, use the following command-line (from <a href=\"https:\/\/www.winhelponline.com\/blog\/open-elevated-command-prompt-windows\/\">admin Command Prompt<\/a>) syntax:<\/p>\n<pre>sc.exe sdshow [service_short_name]<\/pre>\n<p>For Task Scheduler, the <a href=\"https:\/\/www.winhelponline.com\/blog\/how-to-remove-unwanted-service\/\">short name<\/a> is <code>schedule<\/code>, as seen in the Task Scheduler service properties. So, this is the command you&#8217;d run:<\/p>\n<pre>sc.exe sdshow schedule<\/pre>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-19521\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/10\/sc-sdshow-schedule.png\" alt=\"sc sdshow sddl - view and edit service permissions\" width=\"699\" height=\"159\" \/><\/p>\n<p>It returns a weird output (called &#8220;security descriptors&#8221;) that looks like the following:<\/p>\n<pre>D:(A;;CCLCSWLORC;;;<strong>AU<\/strong>)(A;;CCLCSWRPDTLOCRRCWDWO;;;<strong>BA<\/strong>)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;<strong>SY<\/strong>)(A;;CCLCSWLORC;;;<strong>BU<\/strong>)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;<strong>WD<\/strong>)<\/pre>\n<p>The above output shows the Task Scheduler service&#8217;s permission entries in Security Descriptor Definition Language (SDDL) format.<\/p>\n<p><em>The SDDL output can contain DACL as well as SACL entries.\u00a0A DACL identifies users and groups who are allowed or denied access to an object.\u00a0The SACL defines how access is audited on an object. SACL enables administrators to log attempts to access a secured object.<\/em><\/p>\n<ul>\n<li>In this article, let&#8217;s cover only the DACL (denoted by the <code>D:<\/code> at the beginning.) SACL is for a different purpose and is out of the scope of this article.<\/li>\n<\/ul>\n<h3>Security Descriptors meaning<\/h3>\n<p>So, here&#8217;s the meaning of the security descriptors for Task Scheduler service:<\/p>\n<table style=\"border-collapse: collapse; width: 100%;\">\n<tbody>\n<tr>\n<td style=\"width: 20%;\">D:<\/td>\n<td style=\"width: 80%;\">Discretionary ACL (DACL)<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 20%;\">S:<\/td>\n<td style=\"width: 80%;\">System Access Control List (SACL)<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>&nbsp;<\/p>\n<table style=\"border-collapse: collapse; width: 100%;\">\n<tbody>\n<tr>\n<td style=\"width: 20%;\"><strong>ACE type<\/strong><\/td>\n<td style=\"width: 80%;\"><strong>Meaning<\/strong><\/td>\n<\/tr>\n<tr>\n<td style=\"width: 20%;\">A<\/td>\n<td style=\"width: 80%;\">Access Allowed<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>&nbsp;<\/p>\n<table style=\"border-collapse: collapse; width: 100%;\">\n<tbody>\n<tr>\n<td style=\"width: 20%;\"><strong>ACE flags string<\/strong><\/td>\n<td style=\"width: 40%;\">Meaning<\/td>\n<td style=\"width: 40%;\"><\/td>\n<\/tr>\n<tr>\n<td style=\"width: 20%;\">CC<\/td>\n<td style=\"width: 40%;\">SERVICE_QUERY_CONFIG<\/td>\n<td style=\"width: 40%;\">Query the SCM for the service configuration<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 20%;\">LC<\/td>\n<td style=\"width: 40%;\">SERVICE_QUERY_STATUS<\/td>\n<td style=\"width: 40%;\">Query the SCM the current status of the service<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 20%;\">SW<\/td>\n<td style=\"width: 40%;\">SERVICE_ENUMERATE_DEPENDENTS<\/td>\n<td style=\"width: 40%;\"><a href=\"https:\/\/www.winhelponline.com\/blog\/how-to-remove-unwanted-service\/\">List dependent services<\/a><\/td>\n<\/tr>\n<tr>\n<td style=\"width: 20%;\">LO<\/td>\n<td style=\"width: 40%;\">SERVICE_INTERROGATE<\/td>\n<td style=\"width: 40%;\">Query the service its current status<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 20%;\">RC<\/td>\n<td style=\"width: 40%;\">READ_CONTROL<\/td>\n<td style=\"width: 40%;\">Query the security descriptor of the service<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 20%;\">RP<\/td>\n<td style=\"width: 40%;\">SERVICE_START<\/td>\n<td style=\"width: 40%;\">Start the service<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 20%;\">DT<\/td>\n<td style=\"width: 40%;\">SERVICE_PAUSE_CONTINUE<\/td>\n<td style=\"width: 40%;\">Pause\/Resume the service<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 20%;\">CR<\/td>\n<td style=\"width: 40%;\">SERVICE_USER_DEFINED_CONTROL<\/td>\n<td style=\"width: 40%;\"><\/td>\n<\/tr>\n<tr>\n<td style=\"width: 20%;\">WD<\/td>\n<td style=\"width: 40%;\">WRITE_DAC<\/td>\n<td style=\"width: 40%;\">Change the permissions of the service<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 20%;\">WO<\/td>\n<td style=\"width: 40%;\">WRITE_OWNER<\/td>\n<td style=\"width: 40%;\">Change the owner in the object&#8217;s security descriptor.<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 20%;\">WP<\/td>\n<td style=\"width: 40%;\">SERVICE_STOP<\/td>\n<td style=\"width: 40%;\">Stop the service<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 20%;\">DC<\/td>\n<td style=\"width: 40%;\">SERVICE_CHANGE_CONFIG<\/td>\n<td style=\"width: 40%;\">Change service configuration<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 20%;\">SD<\/td>\n<td style=\"width: 40%;\">DELETE<\/td>\n<td style=\"width: 40%;\">The right to <a href=\"https:\/\/www.winhelponline.com\/blog\/how-to-remove-unwanted-service\/\">delete the service<\/a><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><em>For more information, check out <a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/win32\/secauthz\/ace-strings\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">ACE Strings<\/a> and <a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/win32\/services\/service-security-and-access-rights\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">Service Security and Access Rights<\/a> at Microsoft Docs website.<\/em><\/p>\n<p>The last two characters after the ACE strings represent the security principal assigned with these permissions.<\/p>\n<table style=\"border-collapse: collapse; width: 100%;\">\n<tbody>\n<tr>\n<td style=\"width: 20%;\"><strong>Abbreviation<\/strong><\/td>\n<td style=\"width: 80%;\"><strong>Security Principal<\/strong><\/td>\n<\/tr>\n<tr>\n<td style=\"width: 20%;\">AU<\/td>\n<td style=\"width: 80%;\">Authenticated Users<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 20%;\">BA<\/td>\n<td style=\"width: 80%;\">Built-in administrators<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 20%;\">SY<\/td>\n<td style=\"width: 80%;\">Local System<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 20%;\">BU<\/td>\n<td style=\"width: 80%;\">Built-in users<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 20%;\">WD<\/td>\n<td style=\"width: 80%;\">Everyone<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>Let&#8217;s see what rights the &#8220;built-in administrators&#8221; group has, as per this SDDL.<\/p>\n<pre>D:\r\n(A;;CCLCSWLORC;;;<strong>AU<\/strong>)\r\n(A;;CCLCSWRPDTLOCRRCWDWO;;;<strong>BA<\/strong>)\r\n(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;<strong>SY<\/strong>)\r\n(A;;CCLCSWLORC;;;<strong>BU<\/strong>)\r\nS:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;<strong>WD<\/strong>)<\/pre>\n<p>The <strong>built-in administrators<\/strong> (<code>BA<\/code>) group has the following rights:<\/p>\n<table style=\"border-collapse: collapse; width: 100%;\">\n<tbody>\n<tr>\n<td style=\"width: 20%;\"><strong>ACE flags string<\/strong><\/td>\n<td style=\"width: 40%;\"><\/td>\n<td style=\"width: 40%;\"><\/td>\n<\/tr>\n<tr>\n<td style=\"width: 20%;\">CC<\/td>\n<td style=\"width: 40%;\">SERVICE_QUERY_CONFIG<\/td>\n<td style=\"width: 40%;\">Query the SCM for the service configuration<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 20%;\">LC<\/td>\n<td style=\"width: 40%;\">SERVICE_QUERY_STATUS<\/td>\n<td style=\"width: 40%;\">Query the SCM the current status of the service<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 20%;\">SW<\/td>\n<td style=\"width: 40%;\">SERVICE_ENUMERATE_DEPENDENTS<\/td>\n<td style=\"width: 40%;\"><a href=\"https:\/\/www.winhelponline.com\/blog\/how-to-remove-unwanted-service\/\">List dependent services<\/a><\/td>\n<\/tr>\n<tr>\n<td style=\"width: 20%;\">LO<\/td>\n<td style=\"width: 40%;\">SERVICE_INTERROGATE<\/td>\n<td style=\"width: 40%;\">Query the service its current status<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 20%;\">RC<\/td>\n<td style=\"width: 40%;\">READ_CONTROL<\/td>\n<td style=\"width: 40%;\">Query the security descriptor of the service<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 20%;\">RP<\/td>\n<td style=\"width: 40%;\">SERVICE_START<\/td>\n<td style=\"width: 40%;\">Start the service<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 20%;\">DT<\/td>\n<td style=\"width: 40%;\">SERVICE_PAUSE_CONTINUE<\/td>\n<td style=\"width: 40%;\">Pause\/Resume the service<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 20%;\">CR<\/td>\n<td style=\"width: 40%;\">SERVICE_USER_DEFINED_CONTROL<\/td>\n<td style=\"width: 40%;\"><\/td>\n<\/tr>\n<tr>\n<td style=\"width: 20%;\">WD<\/td>\n<td style=\"width: 40%;\">WRITE_DAC<\/td>\n<td style=\"width: 40%;\">Change the permissions of the service<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 20%;\">WO<\/td>\n<td style=\"width: 40%;\">WRITE_OWNER<\/td>\n<td style=\"width: 40%;\">Change the ownership of the service<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>As you can see, the <code>BA<\/code> group doesn&#8217;t have the permissions to stop (WP), change the service configuration (DC), or delete the service (SD).<\/p>\n<p>Whereas the <strong>Local System<\/strong> account (<code>SY<\/code>) has full permissions:<\/p>\n<pre>(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)<\/pre>\n<table style=\"border-collapse: collapse; width: 100%;\">\n<tbody>\n<tr>\n<td style=\"width: 20%;\"><strong>ACE flags string<\/strong><\/td>\n<td style=\"width: 40%;\"><\/td>\n<td style=\"width: 40%;\"><\/td>\n<\/tr>\n<tr>\n<td style=\"width: 20%;\">CC<\/td>\n<td style=\"width: 40%;\">SERVICE_QUERY_CONFIG<\/td>\n<td style=\"width: 40%;\">Query the SCM for the service configuration<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 20%;\">LC<\/td>\n<td style=\"width: 40%;\">SERVICE_QUERY_STATUS<\/td>\n<td style=\"width: 40%;\">Query the SCM the current status of the service<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 20%;\">SW<\/td>\n<td style=\"width: 40%;\">SERVICE_ENUMERATE_DEPENDENTS<\/td>\n<td style=\"width: 40%;\"><a href=\"https:\/\/www.winhelponline.com\/blog\/how-to-remove-unwanted-service\/\">List dependent services<\/a><\/td>\n<\/tr>\n<tr>\n<td style=\"width: 20%;\">LO<\/td>\n<td style=\"width: 40%;\">SERVICE_INTERROGATE<\/td>\n<td style=\"width: 40%;\">Query the service its current status<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 20%;\">RC<\/td>\n<td style=\"width: 40%;\">READ_CONTROL<\/td>\n<td style=\"width: 40%;\">Query the security descriptor of the service<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 20%;\">RP<\/td>\n<td style=\"width: 40%;\">SERVICE_START<\/td>\n<td style=\"width: 40%;\">Start the service<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 20%;\">DT<\/td>\n<td style=\"width: 40%;\">SERVICE_PAUSE_CONTINUE<\/td>\n<td style=\"width: 40%;\">Pause\/Resume the service<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 20%;\">CR<\/td>\n<td style=\"width: 40%;\">SERVICE_USER_DEFINED_CONTROL<\/td>\n<td style=\"width: 40%;\"><\/td>\n<\/tr>\n<tr>\n<td style=\"width: 20%;\">WD<\/td>\n<td style=\"width: 40%;\">WRITE_DAC<\/td>\n<td style=\"width: 40%;\">Change the permissions of the service<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 20%;\">WO<\/td>\n<td style=\"width: 40%;\">WRITE_OWNER<\/td>\n<td style=\"width: 40%;\">Change the ownership of the service<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 20%;\"><strong>WP<\/strong><\/td>\n<td style=\"width: 40%;\">SERVICE_STOP<\/td>\n<td style=\"width: 40%;\">Stop the service<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 20%;\"><strong>DC<\/strong><\/td>\n<td style=\"width: 40%;\">SERVICE_CHANGE_CONFIG<\/td>\n<td style=\"width: 40%;\">Change service configuration<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 20%;\"><strong>SD<\/strong><\/td>\n<td style=\"width: 40%;\">DELETE<\/td>\n<td style=\"width: 40%;\">The right to delete the service<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>As you see, the Local System user has the full permissions (<a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/win32\/services\/service-security-and-access-rights\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">SERVICE_ALL_ACCESS<\/a>), and it can do anything with this service.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-6338 alignleft\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2018\/07\/icotip.gif\" alt=\"tips bulb icon\" width=\"34\" height=\"34\" \/><strong>Alternate method:<\/strong> To stop, restart, or reconfigure the Task Scheduler service, you can use the Local System account. For more information on this topic, see the article <a href=\"https:\/\/www.winhelponline.com\/blog\/run-program-as-system-localsystem-account-windows\/\">How to Run a Program as SYSTEM (LocalSystem) Account in Windows<\/a>. Likewise, for services owned by TrustedInstaller, you can <a href=\"https:\/\/www.winhelponline.com\/blog\/run-program-as-trustedinstaller-locked-registry-keys-files\/\">start Command Prompt as TrustedInstaller<\/a> to manage the service.<\/p>\n<hr \/>\n<h3><a id=\"accesschk\"><\/a>Method 2: Using Sysinternals AccessChk<\/h3>\n<p>Windows Sysinternals AccessChk tool can query the access rights (of specific users or groups) on files, directories, Registry keys, global objects, and Windows services.<\/p>\n<p>To query the Task Scheduler service permissions using AccessChk, run this command from admin Command Prompt:<\/p>\n<pre>accesschk -c schedule -l<\/pre>\n<p>You&#8217;ll get an output like this:<\/p>\n<pre>schedule\r\n  [0] ACCESS_ALLOWED_ACE_TYPE: NT AUTHORITY\\Authenticated Users\r\n\tSERVICE_QUERY_STATUS\r\n\tSERVICE_QUERY_CONFIG\r\n\tSERVICE_INTERROGATE\r\n\tSERVICE_ENUMERATE_DEPENDENTS\r\n\tREAD_CONTROL\r\n  [1] ACCESS_ALLOWED_ACE_TYPE: BUILTIN\\Administrators\r\n\tSERVICE_ALL_ACCESS\r\n  [2] ACCESS_ALLOWED_ACE_TYPE: NT AUTHORITY\\SYSTEM\r\n\tSERVICE_ALL_ACCESS\r\n  [3] ACCESS_ALLOWED_ACE_TYPE: BUILTIN\\Users\r\n\tSERVICE_QUERY_STATUS\r\n\tSERVICE_QUERY_CONFIG\r\n\tSERVICE_INTERROGATE\r\n\tSERVICE_ENUMERATE_DEPENDENTS\r\n\tREAD_CONTROL\r\n<\/pre>\n<p>The above is a neat representation of the SDDL (security descriptor) string you saw in Method 1.<\/p>\n<hr \/>\n<h3><a id=\"psservice\"><\/a>Method 3: Using Sysinternals PsTools<\/h3>\n<p>Windows Sysinternals <a href=\"https:\/\/docs.microsoft.com\/en-us\/sysinternals\/downloads\/psservice\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">PsService<\/a> (part of the PsTools suite) is a service viewer and controller for Windows. Like the SC utility, PsService displays the status, configuration, dependencies of a service, and allows you to start, stop, pause, resume and restart them.<\/p>\n<p>To query the Task Scheduler service permissions using PsService.exe or PsService64.exe, run this command from admin Command Prompt:<\/p>\n<pre>psservice.exe security schedule<\/pre>\n<p>Here&#8217;s it what it outputted:<\/p>\n<pre>SERVICE_NAME: Schedule\r\nDISPLAY_NAME: Task Scheduler\r\n\tACCOUNT: LocalSystem\r\n\tSECURITY:\r\n\t[ALLOW] NT AUTHORITY\\Authenticated Users\r\n\t        Query status\r\n\t        Query Config\r\n\t        Interrogate\r\n\t        Enumerate Dependents\r\n\t        Read Permissions\r\n\t[ALLOW] BUILTIN\\Administrators\r\n\t        All\r\n\t[ALLOW] NT AUTHORITY\\SYSTEM\r\n\t        All\r\n\t[ALLOW] BUILTIN\\Users\r\n\t        Query status\r\n\t        Query Config\r\n\t        Interrogate\r\n\t        Enumerate Dependents\r\n\t        Read Permissions\r\n\r\n<\/pre>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-19806\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/10\/psservice-view-service-permissions.png\" alt=\"psservice64 view service permissions\" width=\"680\" height=\"407\" \/><\/p>\n<p>As you can see above, the output generated by AccessChk and PsService utilities is very friendly, compared to the weird\/cryptic security descriptor codes shown by the SC.exe command-line.<\/p>\n<hr \/>\n<h3><a id=\"setacl\"><\/a>Method 4: Using SetACL.exe utility<\/h3>\n<p>The <a href=\"https:\/\/helgeklein.com\/setacl\/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">SetACL.exe<\/a> utility (from Helge Klein) is an excellent command-line utility that can automate permissions in Windows. Using SetACL, you can view and change ownership and permissions for the file system, <a href=\"https:\/\/www.winhelponline.com\/blog\/take-ownership-registry-key-permissions-command-line-acl\/\">registry<\/a>, printers, network shares, services, etc.<\/p>\n<p>To view the permissions of a service (e.g., Task Scheduler service), run this command:<\/p>\n<pre>SetACL.exe -on \"schedule\" -ot srv -actn list<\/pre>\n<ul>\n<li><code>-on<\/code>\u00a0 &#8211; ObjectName<\/li>\n<li><code>-ot<\/code> &#8211; ObjectType<\/li>\n<li><code>-actn<\/code> &#8211; Action to take<\/li>\n<\/ul>\n<p><em>(For a complete list of command-line switches, check out the official <a href=\"https:\/\/helgeklein.com\/setacl\/documentation\/command-line-version-setacl-exe\/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">SetACL.exe documentation<\/a> at Helge&#8217;s site.)<\/em><\/p>\n<p>You&#8217;ll see the following output (in friendly format):<\/p>\n<pre>schedule\r\n\r\nDACL(not_protected):\r\nAuthenticated Users SERVICE_ENUMERATE_DEPENDENTS+SERVICE_INTERROGATE+SERVICE_QUERY_CONFIG+SERVICE_QUERY_STATUS+READ_CONTROL allow no_inheritance\r\nAdministrators start_stop+WRITE_OWNER+WRITE_DAC allow no_inheritance\r\nSYSTEM full allow no_inheritance\r\nUsers SERVICE_ENUMERATE_DEPENDENTS+SERVICE_INTERROGATE+SERVICE_QUERY_CONFIG+SERVICE_QUERY_STATUS+READ_CONTROL allow no_inheritance\r\n\r\nSetACL finished successfully.<\/pre>\n<h4>View the SDDL<\/h4>\n<p>To view the permissions in SDDL format instead, run this command-line:<\/p>\n<pre>SetACL.exe -on \"schedule\" -ot srv -actn list -lst \"f:sddl\"<\/pre>\n<p>The output will be like below:<\/p>\n<pre>\"schedule\",2,\"D:(A;;CCLCSWLORC;;;AU)(A;;CCLCSWRPWPDTLOCRRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCLCSWLORC;;;BU)\"\r\n\r\nSetACL finished successfully.<\/pre>\n<hr \/>\n<h3>Method 5: Using Sysinternals Process Explorer<\/h3>\n<p>The Process Explorer tool from Windows Sysinternals can be used to view (and edit) service permissions.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-19528\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/10\/procexp-service-permissions-3.png\" alt=\"modify service permissions using process explorer\" width=\"949\" height=\"610\" srcset=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/10\/procexp-service-permissions-3.png 949w, https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/10\/procexp-service-permissions-3-768x494.png 768w\" sizes=\"auto, (max-width: 949px) 100vw, 949px\" \/><\/p>\n<p>See section <a href=\"#procexp\">Using Process Explorer<\/a> at the bottom of this article for more information.<\/p>\n<hr \/>\n<h3><a id=\"sse_tool_view\"><\/a>Method 6: Using Service Security Editor<\/h3>\n<p>The <strong>Service Security Editor<\/strong> utility (third-party freeware) lets you view configure service permissions very easily.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-19561\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/10\/svc-security-editor-1.png\" alt=\"Service Security Editor - service permissions view and modify\" width=\"473\" height=\"279\" \/><\/p>\n<p>See section <a href=\"#sse_tool\">Service Security Editor<\/a> at the bottom of this article for more information.<\/p>\n<hr \/>\n<h2>How to Modify the service permissions<\/h2>\n<p>You can modify the service permissions using many ways. Let&#8217;s see some methods.<\/p>\n<h3><a id=\"sc_sdset\"><\/a>Method 1: Using SC SDSET command-line<\/h3>\n<p>The <code>sc.exe sdshow<\/code> command-line we&#8217;ve seen earlier in this article queries the service permissions. To modify the permissions for a service, you need the <code>sc.exe sdset<\/code> command-line argument.<\/p>\n<p>To give administrators the full control permissions for the Task Scheduler service, you&#8217;d use this SDDL string:<\/p>\n<pre>D:(A;;CCLCSWLORC;;;AU)(A;;<strong>CCDCLCSWRPWPDTLOCRSDRCWDWO<\/strong>;;;BA)(A;;<strong>CCDCLCSWRPWPDTLOCRSDRCWDWO<\/strong>;;;SY)(A;;CCLCSWLORC;;;BU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)<\/pre>\n<p>instead of the original one below:<\/p>\n<pre>D:(A;;CCLCSWLORC;;;AU)(A;;<strong>CCLCSWRPDTLOCRRCWDWO<\/strong>;;;BA)(A;;<strong>CCDCLCSWRPWPDTLOCRSDRCWDWO<\/strong>;;;SY)(A;;CCLCSWLORC;;;BU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)<\/pre>\n<p>To apply the new SDDL for the Task Scheduler service, open an admin Command Prompt window and type this:<\/p>\n<pre>sc.exe sdset schedule D:(A;;CCLCSWLORC;;;AU)(A;;<strong>CCDCLCSWRPWPDTLOCRSDRCWDWO<\/strong>;;;BA)(A;;<strong>CCDCLCSWRPWPDTLOCRSDRCWDWO<\/strong>;;;SY)(A;;CCLCSWLORC;;;BU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)<\/pre>\n<p>You should get the message <code>[SC] SetServiceObjectSecurity SUCCESS<\/code> in the output.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-19523\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/10\/sc-sdset-schedule.png\" alt=\"sc sdset sddl - view and edit service permissions\" width=\"699\" height=\"148\" \/><\/p>\n<p>This grants the following <strong>additional <\/strong>permissions for the Administrators group:<\/p>\n<table style=\"border-collapse: collapse; width: 100%;\">\n<tbody>\n<tr>\n<td style=\"width: 33.3333%;\">WP<\/td>\n<td style=\"width: 33.3333%;\">SERVICE_STOP<\/td>\n<td style=\"width: 33.3333%;\">Stop the service<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 33.3333%;\">DC<\/td>\n<td style=\"width: 33.3333%;\">SERVICE_CHANGE_CONFIG<\/td>\n<td style=\"width: 33.3333%;\">Change service configuration<\/td>\n<\/tr>\n<tr>\n<td style=\"width: 33.3333%;\">SD<\/td>\n<td style=\"width: 33.3333%;\">DELETE<\/td>\n<td style=\"width: 33.3333%;\">The right to delete the service<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>That&#8217;s it. Now, the <strong>Administrators<\/strong> group can start, stop, query, change the configuration, or even delete the service.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-19524\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/10\/sc-sdset-schedule-2.png\" alt=\"sc sdset sddl - view and edit service permissions\" width=\"699\" height=\"147\" \/><\/p>\n<p>The buttons and the startup type options in Task Scheduler properties are now available for Administrators.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-19525\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/10\/mmc-scheduler-options-enabled.png\" alt=\"scheduler service button grayed out - view and edit service permissions\" width=\"406\" height=\"468\" \/><\/p>\n<div class=\"qt\">\n<p><strong>Quick Tip:<\/strong> The permissions for a service are stored in this registry key, in a REG_BINARY value named <code>Security<\/code>:<\/p>\n<pre>HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\[service_name]\\Security<\/pre>\n<p>For example, the Task Scheduler service security info is stored here:<\/p>\n<pre>HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\Schedule\\Security<\/pre>\n<\/div>\n<hr \/>\n<h3><a id=\"procexp\"><\/a>Method 2: Using Sysinternals Process Explorer<\/h3>\n<p>If the service is currently running, you can use the <a href=\"https:\/\/docs.microsoft.com\/en-us\/sysinternals\/downloads\/process-explorer\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">Process Explorer<\/a> tool (again, from Windows Sysinternals) to modify the service permissions.<\/p>\n<ol>\n<li>First, open Task Manager to find the right <code>svchost.exe<\/code> (there will be <a href=\"https:\/\/www.winhelponline.com\/blog\/view-resources-usage-each-service-svchost-windows-10\/\">many svchost.exe instances<\/a>) that hosts the Task Scheduler service. For more information, check out the article <a href=\"https:\/\/www.winhelponline.com\/blog\/services-svchost-windows\/\">How to View the Services Running Under Svchost.exe in Windows<\/a>.<\/li>\n<li>Launch <strong>Process Explorer<\/strong> as administrator.<\/li>\n<li>Double-click the <code>svchost.exe<\/code> process (you can track by PID), which hosts the Task Scheduler service.<br \/>\n<img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-19766\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/10\/procexp-service-permissions-0.png\" alt=\"modify service permissions using process explorer\" width=\"768\" height=\"746\" \/><\/li>\n<li>Click on the Permissions button.<br \/>\n<img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-19527\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/10\/procexp-service-permissions-2.png\" alt=\"modify service permissions using process explorer\" width=\"700\" height=\"559\" \/><\/li>\n<li>In the Permissions dialog, click <strong>Advanced<\/strong>.\u00a0This opens the Advanced Security Settings dialog for the service.<\/li>\n<li>Select Administrators, and click <strong>Edit<\/strong>.<br \/>\n<img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-19528\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/10\/procexp-service-permissions-3.png\" alt=\"modify service permissions using process explorer\" width=\"949\" height=\"610\" srcset=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/10\/procexp-service-permissions-3.png 949w, https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/10\/procexp-service-permissions-3-768x494.png 768w\" sizes=\"auto, (max-width: 949px) 100vw, 949px\" \/><\/li>\n<li>In the Permission Entry dialog, enable the required permission checkboxes accordingly. Note that the Administrators group has already the <strong>Change Permissions<\/strong> and <strong>Change Owner<\/strong> permissions for this service.<\/li>\n<li>Enable <strong>Stop<\/strong> (SERVICE_STOP) and the <strong>Change Config<\/strong> (&#8220;SERVICE_CHANGE_CONFIG&#8221;) checkboxes.<\/li>\n<li>Click OK, and close Process Explorer.<\/li>\n<\/ol>\n<p>You can now fully control the Task Scheduler service as an administrator.<\/p>\n<hr \/>\n<h3><a id=\"sse_tool\"><\/a>Method 3: Using Service Security Editor<\/h3>\n<p><strong>Service Security Editor<\/strong> (ServiceSecurityEditor.exe), a digitally signed executable from Core Technologies Consulting, LLC, is a free standalone utility to view and set permissions for any Windows service easily. You can download the program from the following link:<\/p>\n<pre>https:\/\/www.coretechnologies.com\/products\/ServiceSecurityEditor\/<\/pre>\n<p>Select the service from the list, and click Open&#8230;<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-19561\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/10\/svc-security-editor-1.png\" alt=\"Service Security Editor - service permissions view and modify\" width=\"473\" height=\"279\" \/><\/p>\n<p>This opens the Security settings dialog where you can set your required permissions for the chosen service.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-19560\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/10\/svc-security-editor-2.png\" alt=\"Service Security Editor - service permissions view and modify\" width=\"363\" height=\"445\" \/><\/p>\n<p>Click OK, and click Done to save your settings.<\/p>\n<hr \/>\n<h3><a id=\"setacl_modify\"><\/a>Method 4: Using SetACL.exe utility<\/h3>\n<p>The <a href=\"https:\/\/helgeklein.com\/setacl\/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">SetACL.exe<\/a> utility (from Helge Klein) is an excellent command-line utility that can automate permissions in Windows. Using SetACL, you can view and change ownership and permissions for the file system, <a href=\"https:\/\/www.winhelponline.com\/blog\/take-ownership-registry-key-permissions-command-line-acl\/\">registry<\/a>, printers, network shares, services, etc.<\/p>\n<p>To assign <code>Administrators<\/code> full control permissions (<code>SERVICE_ALL_ACCESS<\/code>) for a service (e.g., Task Scheduler), run this command:<\/p>\n<pre>SetACL.exe -on \"schedule\" -ot srv -actn ace -ace \"n:administrators;p:full\"<\/pre>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-19742\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/10\/setacl-service-permissions-set.png\" alt=\"setacl.exe service permissions\" width=\"701\" height=\"122\" \/><\/p>\n<p><em>(where <code>schedule<\/code> is the <a title=\"How to Delete a Service in Windows 10 and earlier\" href=\"https:\/\/www.winhelponline.com\/blog\/how-to-remove-unwanted-service\/\">short name<\/a> for the Task Scheduler service)<\/em><\/p>\n<ul>\n<li><code>-on<\/code> &#8211; Object Name<\/li>\n<li><code>-ot<\/code> &#8211; Object Type<\/li>\n<li><code>-actn<\/code> &#8211; Action to take<\/li>\n<li><code>-ace<\/code> &#8211; set permissions\/ACE<\/li>\n<li><code>n<\/code> &#8211; Principal (Account or group name)<\/li>\n<li><code>p<\/code> &#8211; Permissions<\/li>\n<li><code>full<\/code> &#8211; full control permissions. For services, it means <code>SERVICE_ALL_ACCESS<\/code>.<\/li>\n<\/ul>\n<p><em>(For a complete list of command-line switches, check out the official <a href=\"https:\/\/helgeklein.com\/setacl\/documentation\/command-line-version-setacl-exe\/\" target=\"_blank\" rel=\"nofollow noopener noreferrer\">SetACL.exe documentation<\/a> at Helge&#8217;s site.)<\/em><\/p>\n<div class=\"rp\"><strong>RELATED:<\/strong> <a href=\"https:\/\/www.winhelponline.com\/blog\/take-ownership-registry-key-permissions-command-line-acl\/\">Take Ownership of a Registry Key &amp; Assign Permissions Using SetACL<\/a><\/div>\n<p>For services, SetACL supports only three permissions levels, namely <code>start_stop<\/code>, <code>read<\/code>, and <code>full<\/code>. Here are the details about each permission level:<\/p>\n<div class=\"qt\">\n<p><strong>read<\/strong><\/p>\n<ul>\n<li>SERVICE_ENUMERATE_DEPENDENTS<\/li>\n<li>SERVICE_INTERROGATE<\/li>\n<li>SERVICE_QUERY_CONFIG<\/li>\n<li>SERVICE_QUERY_STATUS<\/li>\n<li>SERVICE_USER_DEFINED_CONTROL<\/li>\n<li>READ_CONTROL<\/li>\n<\/ul>\n<p><strong>start_stop<\/strong><\/p>\n<ul>\n<li>SERVICE_ENUMERATE_DEPENDENTS<\/li>\n<li>SERVICE_INTERROGATE<\/li>\n<li>SERVICE_PAUSE_CONTINUE<\/li>\n<li>SERVICE_QUERY_CONFIG<\/li>\n<li>SERVICE_QUERY_STATUS<\/li>\n<li>SERVICE_START<\/li>\n<li>SERVICE_STOP<\/li>\n<li>SERVICE_USER_DEFINED_CONTROL<\/li>\n<li>READ_CONTROL<\/li>\n<\/ul>\n<p><strong>full<\/strong><\/p>\n<ul>\n<li>SERVICE_CHANGE_CONFIG<\/li>\n<li>SERVICE_ENUMERATE_DEPENDENTS<\/li>\n<li>SERVICE_INTERROGATE<\/li>\n<li>SERVICE_PAUSE_CONTINUE<\/li>\n<li>SERVICE_QUERY_CONFIG<\/li>\n<li>SERVICE_QUERY_STATUS<\/li>\n<li>SERVICE_START<\/li>\n<li>SERVICE_STOP<\/li>\n<li>SERVICE_USER_DEFINED_CONTROL<\/li>\n<li>READ_CONTROL<\/li>\n<li>WRITE_OWNER<\/li>\n<li>WRITE_DAC DELETE<\/li>\n<\/ul>\n<\/div>\n<h4>Comparison: SDDL changes for Task Scheduler<\/h4>\n<pre>[Before (Windows-default permission level)]\r\nD:(A;;CCLCSWLORC;;;AU)(A;;<strong>CCLCSWRPWPDTLOCRRCWDWO<\/strong>;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCLCSWLORC;;;BU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)\r\n\r\n[After assigning full control permissions for <code>Administrators<\/code>(BA)] D:(A;;CCLCSWLORC;;;AU)(A;;<strong>CCDCLCSWRPWPDTLOCRSDRCWDWO<\/strong>;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCLCSWLORC;;;BU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)<\/pre>\n<p>The options in the Task Scheduler service properties dialog won&#8217;t be <a title=\"Task Scheduler Service Grayed Out in Services MMC\" href=\"https:\/\/www.winhelponline.com\/blog\/task-scheduler-service-grayed-out-windows\/\">grayed out<\/a> now.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-19525\" src=\"https:\/\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/10\/mmc-scheduler-options-enabled.png\" alt=\"scheduler service button grayed out - view and edit service permissions\" width=\"406\" height=\"468\" \/><\/p>\n<p><em><strong>Editor&#8217;s note:<\/strong> If you need to assign granular permissions (e.g., grant <code>SERVICE_START<\/code> but not <code>SERVICE_STOP<\/code>, or the other way) for a user or group, then SetACL may not be your best option. You can use one of the other methods described in this article.<\/em><\/p>\n<h2>SDDL &#8211; References<\/h2>\n<p>Here are some links to third-party articles where you can learn more about the SDDL strings.<\/p>\n<pre>Understanding SDDL Syntax | IT Connect:\r\nhttps:\/\/itconnect.uw.edu\/wares\/msinf\/other-help\/understanding-sddl-syntax\/\r\n\r\nSet permissions on a specific service (Windows) \u2013 My Notes to Myself and Others\u2026:\r\nhttps:\/\/blogs.msmvps.com\/erikr\/2007\/09\/26\/set-permissions-on-a-specific-service-windows\/\r\n\r\nSDDL Explained | clan8blog:\r\nhttps:\/\/clan8blog.wordpress.com\/2016\/08\/08\/sddl-explained\/\r\n\r\nGetting started with SDDL (Security Descriptor Definition Language) - lewisroberts.com:\r\nhttps:\/\/www.lewisroberts.com\/2010\/09\/16\/getting-started-with-sddl\/\r\n\r\nCheck Windows services status - what privilege do I need - Stack Overflow:\r\nhttps:\/\/stackoverflow.com\/questions\/26724423\/check-windows-services-status-what-privilege-do-i-need?lq=1\r\n\r\nIf you ask for STANDARD_RIGHTS_REQUIRED, you may as well ask for the moon | The Old New Thing:\r\nhttps:\/\/devblogs.microsoft.com\/oldnewthing\/20080227-00\/?p=23303<\/pre>\n<p><em>I hope the brief introduction to SDDL and the information to view and modify the Service permissions proved useful. Let&#8217;s know your comments.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Summary: This article explains the various methods to view the permissions for any Service in Windows. It also covers the tools and methods to modify the service permissions easily. Just as file system objects and registry keys have permissions, each service in Windows can have a set of permissions. The permission entries for a service &#8230; <a title=\"How to View and Modify Service Permissions in Windows\" class=\"read-more\" href=\"https:\/\/www.winhelponline.com\/blog\/view-edit-service-permissions-windows\/\" aria-label=\"Read more about How to View and Modify Service Permissions in Windows\">Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[6,7],"tags":[106,780],"class_list":["post-19520","post","type-post","status-publish","format-standard","hentry","category-utilities","category-windows","tag-command-prompt","tag-setacl"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":44,"url":"https:\/\/www.winhelponline.com\/blog\/task-scheduler-service-grayed-out-windows\/","url_meta":{"origin":19520,"position":0},"title":"Task Scheduler Service Grayed Out in Services MMC","author":"Ramesh","date":"March 4, 2008","format":false,"excerpt":"When you open the Services management console (services.msc), the Task Scheduler service may be in a disabled state. In the Task Scheduler properties page, all the options may be grayed out, and the service Startup type cannot be changed. RELATED: How to View and Modify Service Permissions in Windows This\u2026","rel":"","context":"In &quot;Windows&quot;","block_context":{"text":"Windows","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2008\/03\/schedule-grayed.png?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]},{"id":10160,"url":"https:\/\/www.winhelponline.com\/blog\/windows-update-service-properties-are-grayed-out-in-services-mmc\/","url_meta":{"origin":19520,"position":1},"title":"Windows Update Service Properties Grayed Out in Services MMC","author":"Ramesh","date":"July 4, 2019","format":false,"excerpt":"When you open the Services MMC (services.msc) and double-click Windows Update service properties, the Start and Stop buttons are grayed out. Also, you may be unable to change the service Startup type. As a workaround, you can change the service startup and other settings using the registry or run the\u2026","rel":"","context":"In &quot;Windows 10&quot;","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"windows update service properties tab grayed out - wuauserv sddl fix","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2019\/07\/wu-properties-grayed-out.png?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]},{"id":1505,"url":"https:\/\/www.winhelponline.com\/blog\/how-to-take-ownership-of-registry-keys-and-assign-full-permissions\/","url_meta":{"origin":19520,"position":2},"title":"Take Ownership of a Registry Key And Assign Full Permissions","author":"Ramesh","date":"August 28, 2015","format":false,"excerpt":"Certain areas of the Windows registry cannot be accessed due to the Permissions assigned (or lack thereof) for those keys. For instance, some registry keys are owned by the LocalSystem account, and some are owned by TrustedInstaller. There are legitimate cases where you need to access a registry key to\u2026","rel":"","context":"In &quot;Windows&quot;","block_context":{"text":"Windows","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2009\/10\/reg-key-error-delete.png?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]},{"id":46389,"url":"https:\/\/www.winhelponline.com\/blog\/0xc1510111-no-permissions-to-mount-modify-wim\/","url_meta":{"origin":19520,"position":3},"title":"Error 0xc1510111: You do not have permissions to mount and modify this image","author":"Ramesh","date":"May 16, 2023","format":false,"excerpt":"When you use DISM to mount a WIM file, the error code 0xc1510111 appears. The full error message is below: Error: 0xc1510111 You do not have permissions to mount and modify this image. Verify that you have Read\/Write permissions or mount the image using the \/ReadOnly option. Note that you\u2026","rel":"","context":"In &quot;Windows 10&quot;","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"ISO WIM file readonly","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2023\/05\/0xc1510111-readonly-attributes-remove.png?resize=350%2C200&ssl=1","width":350,"height":200},"classes":[]},{"id":31313,"url":"https:\/\/www.winhelponline.com\/blog\/windows-update-service-access-denied-startup-type\/","url_meta":{"origin":19520,"position":4},"title":"Windows Update Service &#8220;Access is Denied&#8221; When Changing Startup Type","author":"Ramesh","date":"December 27, 2022","format":false,"excerpt":"When you open the Services MMC and change the Windows Update service's startup type, the \"Access is denied\" error occurs after clicking Apply or OK. Cause The above error occurs due to tightened permissions for the Windows Update service's registry key(s). Resolution To resolve the issue, change ownership of the\u2026","rel":"","context":"In &quot;Windows 10&quot;","block_context":{"text":"Windows 10","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/windows-10\/"},"img":{"alt_text":"wuauserv registry change ownership","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2022\/12\/wuauserv-registry-ownership-change.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2022\/12\/wuauserv-registry-ownership-change.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2022\/12\/wuauserv-registry-ownership-change.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2022\/12\/wuauserv-registry-ownership-change.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":19688,"url":"https:\/\/www.winhelponline.com\/blog\/compressed-zip-folder-error-file-not-found-no-read-permission\/","url_meta":{"origin":19520,"position":5},"title":"Compressed (Zipped) Folder Error &#8220;File not found or no read permission&#8221;","author":"Ramesh","date":"November 4, 2020","format":false,"excerpt":"When you try to create a compressed (zipped) folder in Windows 10, the following error occurs: Compressed (zipped) Folders Error File not found or no read permission. You may have noticed that this error doesn't happen on drives formatted as FAT32.\u00a0This article explains why this problem occurs and how to\u2026","rel":"","context":"In &quot;Windows&quot;","block_context":{"text":"Windows","link":"https:\/\/www.winhelponline.com\/blog\/category\/microsoft\/windows\/"},"img":{"alt_text":"compressed folder create error - no read permissions - process explorer","src":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/11\/procexp-find-locked-files.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/11\/procexp-find-locked-files.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/www.winhelponline.com\/blog\/wp-content\/uploads\/2020\/11\/procexp-find-locked-files.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]}],"_links":{"self":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts\/19520","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/comments?post=19520"}],"version-history":[{"count":0,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/posts\/19520\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/media?parent=19520"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/categories?post=19520"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.winhelponline.com\/blog\/wp-json\/wp\/v2\/tags?post=19520"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}