How to query the account which has created a Windows service

Question

Good morning,
I'm writing installation procedure for a product, which embeds a Windows service. In order to install that service, a wrapper is used, referring to a configuration (java -jar wrapper.jar -i <product>.conf).

Now there seems to be some link towards the account: when a Windows service is installed as Account1, then it can't be started/stopped by Account2.

So, I (Account2) would like to interrogate the Windows service, and say "If you are installed by Account1, then you need to be uninstalled and I'll install you myself".

Now the question: how can I know which account has installed the mentioned Windows service? I've already tried:

sc query <Service_Name>
sc qc <Service_Name>
sc qprivs <Service_Name>
sc qmanagedaccount <Service_Name>
sc quserservice <Service_Name>
wmic service <Service_Name> list full

(You see, I'm getting desperate :-) )

None of the mentioned commands has given the username "Account1".

Does anybody know how to do this?

Is there a reason you're not using a brute force approach (always remove and add again)? Did you try to change the security descriptor? If it can't be started or stopped by another account, it's likely that said account is just missing the permission to do so. Is said account able to start/stop other services? — Seth, Apr 07 '17 at 10:07
Not _quite_ a duplicate, but see https://superuser.com/a/315709/1686 — u1686_grawity, Apr 07 '17 at 10:49
My customer has different accounts. Using the first account, he does the whole installation, including the Windows Service installation. Later he performs a complete configuration, based on that Windows Service. Afterwards (just for updating), he logs on as another user and starts updating. My installation procedure now uninstalls and re-installs the Windows Service, with two problems: wrong username (should be the first one) and the configuration is lost. Therefore I'd like to be able to install a Windows Service under a different username (but how to know the one which we have now?). — Dominique, Apr 07 '17 at 11:24

score 0 · Accepted Answer · edited Aug 08 '17 at 21:24

How can I know which account has installed a Windows service?

You can use wevtutil to retrieve this information:

Retrieve information about event logs and publishers. Archive logs in a self-contained format, Enumerate the available logs, Install and uninstall event manifests, run queries, Exports events (from an event log, from a log file, or using a structured query) to a specified file, Clear event logs.

The event you need to look for is Event ID 4697: A service was installed in the system.:

A new service was installed by the user indicated in the subject. Subject often identifies the local system (SYSTEM) for services installed as part of native Windows components and therefore you can't determine who actually initiated the installation.

Subject:

The user and logon session that performed the action.

Security ID: The SID of the account.

Account Name: The account logon name.

Account Domain: The domain or - in the case of local accounts - computer name.

Logon ID is a semi-unique (unique between reboots) number that identifies the logon session. Logon ID allows you to correlate backwards to the logon event (4624) as well as with other events logged during the same logon session.

Service Information:

Service Name: the internal system name of the new service.Use "sc query" to get a cross reference of service names and their more familiar display names.

The following command will show the Account Name for the last created service:

wevtutil query-events System /count:1 /rd:true /format:text /q:"Event[System[(EventID=4697)]]"

If you created the service using the sc create command, then you will need to search for Event ID: 7045 Source: service control manager and look for User Name:

wevtutil query-events System /count:1 /rd:true /format:text /q:"Event[System[(EventID=7045)]]"

Example:

> sc create Notepad binpath= c:\windows\system32\Notepad.exe
[SC] CreateService SUCCESS

> wevtutil query-events System /count:1 /rd:true /format:text /q:"Event[System[(EventID=7045)]]"
Event[0]:
  Log Name: System
  Source: Service Control Manager
  Date: 2017-04-07T14:35:32.600
  Event ID: 7045
  Task: N/A
  Level: Information
  Opcode: N/A
  Keyword: Classic
  User: S-1-5-21-1699878757-1063190524-3119395976-1000
  User Name: Hal\DavidPostill
  Computer: Hal
  Description:
A service was installed in the system.

Service Name:  Notepad
Service File Name:  c:\windows\system32\Notepad.exe
Service Type:  user mode service
Service Start Type:  demand start
Service Account:  LocalSystem

How to query the account which has created a Windows service

1 Answers1

How can I know which account has installed a Windows service?

Further Reading