jperezduerto.info
Security in depth · Unit 22 · Lesson 42 of 44
Service SIDs make permissions more specific
Explain why adding a service-specific grant does not remove a broader shared-account grant.
Helpful before thisWindows privilege escalation
After this lesson you can
- Compare service SID membership and resource permissions before claiming service isolation.
Specific identity needs specific policy
A service SID is an identifier associated with a Windows service. When the configured SID type includes it in the service process token, a resource ACL can name that service specifically. This does not create a new login account or a separate password.
SID type matters. A restricted configuration adds token restrictions; simply naming the service does not apply them. Process hosting also matters, so do not assume services sharing a host process have independent token boundaries.
Supplied two-service packet
Assume services A and B run in separate processes under the same ordinary base account. Their service SIDs are enabled in their respective tokens, with unrestricted SID type and no additional restricted-token checks or overrides. Fresh ordinary access checks apply.
The owner approves only A to write Cache-A. The supplied ACL has two effective allow paths:
- A’s service SID: write Cache-A.
- Shared base account: write Cache-A.
Service B’s token contains the shared base-account identity. It can therefore satisfy the second grant even without A’s service SID. The new service-specific entry has not removed that broad path.
Verify the boundary you intended
The platform owner should review why the shared grant exists and which legitimate work depends on it. A narrower proposal must preserve A’s required cache work and approved maintenance while denying B’s ordinary write in the reviewed context. Record token membership, SID type, hosting assumptions, and effective resource permissions together.
This example establishes a permission-design gap, not actual interference between services. It also does not establish isolation on remote servers, where the service’s network identity needs its own review.
Terms you met
Check yourself
No timer. No penalties. Read the explanation and try again whenever you like.
This lesson’s questions have changed. Your reading progress is saved; review the updated questions.
-
Only service A should write its cache, but the ACL permits both A's service SID and the shared base account. Under the stated ordinary-token assumptions, what remains?
Show the answer
Correct answer: Service B can still receive write access through the shared-account grant. Adding a narrower grant does not cancel the existing broader path shared by both tokens.
Try it
- WriteWrite an isolation review for services A and B: intended owner, both grant paths, the unresolved broad grant, and the allowed/denied results required after any approved correction.