Granting Remote Access on SCManager to Non-admin Users

Let’s consider the peculiarities of granting remote access permission to enumerate the list of services running on a remote server to domain users without rights of local administrators. In fact, the task comes down to providing remote connection to the Service Control Manager (SCManager).

Here is what the problem looks like. Suppose, we want a remote user or monitoring system can query the status of services on some server. On obvious reasons, this remote user doesn’t have any administrative rights and a privilege to access the server locally.

When trying to connect and get the list of services on the remote computer using services.msc console, the user sees the following error:

If you try to get the list of services on a remote server using sc.exe, the error is as follows:

C:\Windows\system32>sc \\lonts-01 query

The access to the list of services is controlled by the security descriptor of Service Control Manager database, for which the remote access of the users from the “Authenticated Users” was restricted in Windows 2003 SP1 already (that is quite logical). Only members of the Local Administrators group have the right to access this service remotely.

Let’s consider how to grant the remote access to Service Control Manager to get the list of services on a server and how common users (without administrative rights) can get statuses of these services in Windows Server 2012 R2.

Current Service Control Manager (SCM) permissions can be obtained using sc.exe by running the following command in the command prompt run with the administrator privileges:

sc sdshow scmanager

The command returns a similar SDDL string:

D:(A;;CC;;;AU)(A;;CCLCRPRC;;;IU)(A;;CCLCRPRC;;;SU)(A;;CCLCRPWPRC;;;SY)(A;;KA;;;BA)(A;;CC;;;AC)S:(AU;FA;KA;;;WD)(AU;OIIOFA;GA;;;WD)

In this case you can see that by default the Authenticated Users (AU) group is allowed only to connect using SCM, but not to poll (LC) the services. Copy this string to any text editor.

The next step is to get an SID of a user or group we want to grant the right on the remote access to SCM to (How to get a user SID by username). For example, let’s get an SID of the AD group lon-hd:

Get-ADgroup -Identity lon-hd | select SID
SID
---
S-1-5-21-2470146451-39123456388-2999995117-23338978

Copy the block (A;;CCLCRPRC;;;IU) – (IU means Interactive Users) from the SDDL string in your text editor, replace IU in the copied block with the SID of a user/group and paste the string you get before S:

In our case we have got the following string:

D:(A;;CC;;;AU)(A;;CCLCRPRC;;;IU)(A;;CCLCRPRC;;;SU)(A;;CCLCRPWPRC;;;SY)(A;;KA;;;BA)(A;;CC;;;AC)(A;;CCLCRPRC;;;S-1-5-21-2470146451-39123456388-2999995117-23338978)S:(AU;FA;KA;;;WD)(AU;OIIOFA;GA;;;WD)

Now let’s change the parameters of Service Control Manager security descriptor:

sc sdset scmanager “D:(A;;CC;;;AU)(A;;CCLCRPRC;;;IU)(A;;CCLCRPRC;;;SU)(A;;CCLCRPWPRC;;;SY)(A;;KA;;;BA)(A;;CC;;;AC)(A;;CCLCRPRC;;;S-1-5-21-2470146451-39123456388-2999995117-23338978)S:(AU;FA;KA;;;WD)(AU;OIIOFA;GA;;;WD)“

The string [SC] SetServiceObjectSecurity SUCCESS tells that the new security parameters have been successfully applied, and the user has got the privileges similar to those of locally authenticated users: SC_MANAGER_CONNECT, SC_MANAGER_ENUMERATE_SERVICE, SC_MANAGER_QUERY_LOCK_STATUS and STANDARD_RIGHTS_READ.

Make sure that a remote user can get the list of services and their status from services.msc console using sc \\srv-name1 query

Naturally, you don’t have any privileges to manage the services, since the access to each service is controlled by an individual ACL. To grant the privileges to start/stop server services to a user, follow the instructions in the article How to Grant Permissions to Manage (Start, Stop or Restart) Windows Services to a User.