Can Windows standard user change service startup type?

Question

I would like to know if Windows standard user can normally change service startup type and how to prevent it. A customer reports that on Windows 7 (64-bit) he was able to change startup type from Automatic to Disabled for services of our product, thus disabling the product. Could this be true and is it possible on a standard Windows 7 installation?

score 2 · Answer 1 · answered Jul 25 '11 at 11:15

2

I just logged into a Windows 7 test machine as a standard user, and the options to change it are grayed out. I suspect he has more rights than he realizes, even if not an administrator.

enter image description here

answered Jul 25 '11 at 11:15

KCotreau

25,519
5
48
72

score 2 · Accepted Answer · answered Jul 25 '11 at 11:19

2

On a standard Windows 7 installation it is not possible. That user must have:

Elevated his privileges before performing that operation by inserting an administration password, or
Benefited from a disabled UAC, or
Unknowingly be using an account with administrative privileges, or
Have seen his rights and permissions roles changed in the Local group Policy Editor.

answered Jul 25 '11 at 11:19

A Dwarf

18,981
2
44
66

2

Disabling the UAC would have no effect. It only affects whether Windows 7 would ask if you want to run certain programs at an elevated level. He would still be limited by his given permissions, which are probably unknowingly administrative, which is really why he could make the change. I just tested the same account below after turning off UAC and rebooting, and the same: Grayed out. – KCotreau Jul 25 '11 at 11:33
Thank you for the answer. I wonder though, does disabling UAC really affect standard users, too? – Kaitnieks Jul 25 '11 at 11:35
Yes, if coupled with other situations like operating under a administrative account. That is, if you unknowingly have an administrator account and UAC is not disabled you will still get a warning. – A Dwarf Jul 25 '11 at 11:40

score 2 · Answer 3 · answered Jul 25 '11 at 11:56

Each Windows service has an ACL attached (just like files or registry keys do). By default, the ACL only allows modifications to Administrators, but it's possible to have it changed to allow certain operations to any user. It's unlikely that this is the case, though – service ACLs are hidden in a rather inconvenient place.

Can Windows standard user change service startup type?

3 Answers3