Can Windows standard user change service startup type?

Question

I would like to know if Windows standard user can normally change service startup type and how to prevent it. A customer reports that on Windows 7 (64-bit) he was able to change startup type from Automatic to Disabled for services of our product, thus disabling the product. Could this be true and is it possible on a standard Windows 7 installation?

score 2 · Answer 1 · answered Jul 25 '11 at 11:15

2

I just logged into a Windows 7 test machine as a standard user, and the options to change it are grayed out. I suspect he has more rights than he realizes, even if not an administrator.

enter image description here

answered Jul 25 '11 at 11:15

KCotreau

25,622

score 2 · Accepted Answer · answered Jul 25 '11 at 11:19

On a standard Windows 7 installation it is not possible. That user must have:

Elevated his privileges before performing that operation by inserting an administration password, or
Benefited from a disabled UAC, or
Unknowingly be using an account with administrative privileges, or
Have seen his rights and permissions roles changed in the Local group Policy Editor.

score 2 · Answer 3 · answered Jul 25 '11 at 11:56

Each Windows service has an ACL attached (just like files or registry keys do). By default, the ACL only allows modifications to Administrators, but it's possible to have it changed to allow certain operations to any user. It's unlikely that this is the case, though – service ACLs are hidden in a rather inconvenient place.

Can Windows standard user change service startup type?

3 Answers3