jperezduerto.info
Security in depth · Unit 22 · Lesson 31 of 44
Service configuration is authority
Separate viewing service status, controlling execution, and changing configuration.
Helpful before thisWindows privilege escalation
After this lesson you can
- Match service-management rights to an approved support task.
One idea. One situation. One reasoned decision.
How it works
A service’s executable, configuration, dependencies, and management permissions jointly influence what it does. Review who can change each component and whether that authority is consistent with the identity under which the service runs. Protecting only the main file leaves an incomplete picture. Keep configuration changes accountable, validate dependencies, and give maintainers only the management operations their role requires.
Read the supplied record
A fictional service review starts with requirements, not a convenience role:
| Role | Approved task |
|---|---|
| Support | View status |
| Operations | Start or stop under an approved procedure |
| Release maintainers | Change approved configuration |
These tasks correspond to different management rights. Grouping everyone into one broad service-administration role hides those distinctions. Record the particular operations each role needs and the evidence for the grant.
Service-object permissions are separate from permissions on the executable, configuration files, registry data, and other dependencies. A narrow service-object DACL cannot establish that every input is protected. Likewise, a protected executable does not settle who can manage the service object.
The runtime identity introduces another question: what resources does the running service need? Its task permissions and the maintainer’s change permissions should each have a clear purpose. A professional review accounts for both while preserving normal support work.
The key distinction: The complete service behavior depends on more than one file.
Check yourself
No timer. No penalties. Read the explanation and try again whenever you like.
This lesson’s questions have changed. Your reading progress is saved; review the updated questions.
-
Support only needs to view a service’s status. Which proposed right directly matches that task?
Show the answer
Correct answer: SERVICE_QUERY_STATUS, with other required access evaluated separately. This right corresponds to querying status. It does not itself authorize configuration changes or every other operation.
Try it
- WriteWrite a one-row access proposal for Support and list the separate evidence needed about the service’s files and runtime identity.