Set/view permissions on a Windows service

A Microsoft resource kit tool (subinacl.exe) exists to set/view permissions for different parts of the Windows Server system. You can use subinacl.exe to handle the following objects;

• Files
• Services
• Registry keys
• Shares
• IIS/metabase
• Printers

To view permissions on a windows service run the following command;

subinacl.exe /service <servicename>

To grant full permissions for a user run the following command;

subinacl.exe /service <servicename> /grant=computer\user=F
or
subinacl.exe /service <servicename> /grant=domain\user=F

The different permissions you can set for a service are;

• F = Full Control
• R = Read
• W = Write
• X = eXecute
• L = Read control
• Q = Query Service Config,
• S = Query Service Status
• E = View Dependent Services,
• C = Service Change Config,
• T = Start Service
• O = Stop Service
• P = Pause service
• I = Interrogate Service
• U = Service User-Defined Control Commands