Running a windows service as a privileged user

0
votes

I have a windows service, written in c++, and I need it to start with privileged rights eg. administrator or system. The service needs access to %SYSTEMROOT%, %USERPROFILES%, %TEMP% and so on. The service will run under windows XP and 7.

The service is going to be deployed using GPOs, so local accounts can't be used.

Can I set the user in the service itself? If, how? And if not, how can I deploy it using GPO?

Any ideas? Thanks

1
c++windowsservice

1 Answers

1
votes

You don't set the user from the service (i.e. from code). Rather you set the user account that runs the service when you deploy/install it.

Your options for installing a Windows service are

  • to build an MSI package and take advantage of the Windows Installer infrastructure
  • manually deploy using the command line (i.e. us a Batch file and the sc command)

When using the sc command you can set the user account for a service using the following command:

sc config <servicename> obj= <accountname> password= <password>

When deploying via Windows Installer you can configure the user account in the MSI.

Then, you can use Group Policy to remotely install/deploy your service either using the MSI or via the other method.