SetServiceObjectSecurity function (winsvc.h)
[SetServiceObjectSecurity is available for use in the operating systems specified in the Requirements section. It may be altered or unavailable in subsequent versions. Instead, use the SetNamedSecurityInfo function.]
The SetServiceObjectSecurity function sets the security descriptor of a service object.
Syntax
BOOL SetServiceObjectSecurity(
[in] SC_HANDLE hService,
[in] SECURITY_INFORMATION dwSecurityInformation,
[in] PSECURITY_DESCRIPTOR lpSecurityDescriptor
);
Parameters
[in] hService
A handle to the service. This handle is returned by the OpenService or CreateService function. The access required for this handle depends on the security information specified in the dwSecurityInformation parameter.
[in] dwSecurityInformation
Specifies the components of the security descriptor to set. This parameter can be a combination of the following values. Note that flags not handled by SetServiceObjectSecurity will be silently ignored.
| Value | Meaning |
|---|---|
|
Sets the discretionary access control list (DACL) of the object. The handle specified by hService must have WRITE_DAC access, or the calling process must be the owner of the object. |
|
Sets the primary group security identifier (SID) of the object. The handle specified by hService must have WRITE_OWNER access, or the calling process must be the owner of the object. |
|
Sets the SID of the owner of the object. The handle specified by hService must have WRITE_OWNER access, or the calling process must be the owner of the object or have the SE_TAKE_OWNERSHIP_NAME privilege enabled. |
|
Sets the system access control list (SACL) of the object. The handle specified by hService must have ACCESS_SYSTEM_SECURITY access.
To obtain ACCESS_SYSTEM_SECURITY access
|
[in] lpSecurityDescriptor
A pointer to a SECURITY_DESCRIPTOR structure that contains the new security information.
Return value
If the function succeeds, the function returns nonzero.
If the function fails, it returns zero. To get extended error information, call GetLastError.
The following error codes can be set by the service control manager. Other error codes can be set by the registry functions that are called by the service control manager.
| Return code | Description |
|---|---|
|
The specified handle was not opened with the required access, or the calling process is not the owner of the object. |
|
The specified handle is not valid. |
|
The specified security information or security descriptor is not valid. |
|
The specified service has been marked for deletion. |
Remarks
The SetServiceObjectSecurity function sets the specified portions of the security descriptor of the service object based on the information specified in the lpSecurityDescriptor buffer. This function replaces any or all of the security information associated with the service object, according to the flags set in the dwSecurityInformation parameter and subject to the access rights of the calling process.
When a service is created, the service control manager assigns a default security descriptor to the service object. To retrieve a copy of the security descriptor for a service object, call the QueryServiceObjectSecurity function. For a description of the default security descriptor for a service object, see Service Security and Access Rights.
Note that granting certain access to untrusted users (such as SERVICE_CHANGE_CONFIG or SERVICE_STOP) can allow them to interfere with the execution of your service and possibly allow them to run applications under the LocalSystem account.
Requirements
| Requirement | Value |
|---|---|
| Minimum supported client | Windows XP [desktop apps only] |
| Minimum supported server | Windows Server 2003 [desktop apps only] |
| Target Platform | Windows |
| Header | winsvc.h (include Windows.h) |
| Library | Advapi32.lib |
| DLL | Advapi32.dll |