Blake W

Is there any way to start a service in Windows Vista programmatically without having admin privileges (UAC turned on) When our main menu of our product is started up, it checks to see if our database service is running. If it isn't, the main menu would silently start the service. This worked fine on 2000/XP. Now I need to get admin privileges in order to start it. This won't work for our customers as many users will only be standard users in Vista and an administrator won't be around all the time to enter a password.

Our service is automatically started when the OS boots but has the ability to shut itself down when we need it to (for updating purposes and the such).

Is there any way around this and to be able to start a service without admin privileges programmatically Thanks!!

Blake W


Re: Application Compatibility for Windows Vista Starting a service in Vista

Bruce N. Baker - MSFT

You'll need an "update" application that has admin privledges that can shutdown and restart your service. (Assuming this is the only reason your shutting down your service).






Re: Application Compatibility for Windows Vista Starting a service in Vista

Blake W

There are other user level utilities that will need to start and stop the service as well. It should not matter which application needs to start and stop the service, it just needs to work without admin privileges.

Our product is a POS/inventory system installed in a store. A regular employee may be starting our software and possibly start the database service if it is down. It is not acceptable to assume that an administrator will be around to punch in a password in order to do this simple task. Some of our clients have very high security settings on thier systems and will not permit much of the staff to have admin accounts - we must assume the users of our software have no admin access. For the "updater" application, it cannot be assumed to have admin privileges as it is more than likely run during the night and the first employee in the morning needs to start up the system.

One solution, which seems like a bad workaround, is to have another service running and it's only job is to start and stop our other service(s). I'm not very fond of this solution though.

Blake W




Re: Application Compatibility for Windows Vista Starting a service in Vista

AndyCadley

You could ACL the service to allow the Users group to Start/Stop it, but that doesn't seem a terribly robust way of doing things. Whatever "updates" your service is going to need Administrator rights in order to actually perform the update in any case, is it not

I'd favour having the service itself launch an "updater" executable (in the system context) that stops the service, updates it, then restarts it without ever relying on user intervention.





Re: Application Compatibility for Windows Vista Starting a service in Vista

Aaron Margosis - MSFT

Or you could just grant the user the right to start the service but not to stop it. Having the user (or malware running as the user) stop the service might be a denial of service. (Quite literally - pun not intended.)

"SC.EXE SDSET" is a command-line tool you can use to configure permissions on the service (requires admin to change the permissions, of course, and knowledge of SDDL). I'm pretty sure you can also change the permissions with a security template.

HTH





Re: Application Compatibility for Windows Vista Starting a service in Vista

IanD

Blake,

Have any of these sugestions been usefull for you My company is having me do research on the subject so any help would be great





Re: Application Compatibility for Windows Vista Starting a service in Vista

Blake W

Ian,

Our company has decided to set start and stop permissions for the Everyone system group for our service. This will be done through our Product Installation so that the end users do not need to know about it. We had found resources on the web on how to do this.

Hope this helps...





Re: Application Compatibility for Windows Vista Starting a service in Vista

IanD

So on instilation only your service will have the stop/start permission to the group EVERYONE, and that will not effect any of the other services Can you point me in the right direction so i can show this to my developers