“Access is denied” when trying to start service even when running Administrator/elevated

It turns out I wasn't giving enough permissions with subinacl. The possible access values for the grant action are:

    F : Full Control  
    R : Generic Read  
    W : Generic Write  
    X : Generic eXecute  
  or any following values  
    L : Read controL  
    Q : Query Service Configuration  
    S : Query Service Status  
    E : Enumerate Dependent Services  
    C : Service Change Configuration  
    T : Start Service  
    O : Stop Service  
    P : Pause/Continue Service  
    I : Interrogate Service  
    U : Service User-Defined Control Commands  

I was using S (Query Service Status), T (Start Service), and O (Stop Service). I also needed E (Enumerate Dependent Services). It appears that the PowerShell cmdlets need to look at dependent services when starting/stopping.

Here's my updated subinacl command:

subinacl.exe /service MyService /GRANT=MyServiceControlUser=STOE

If you don't want to download/use subinacl.exe, you can use PowerShell via the Carbon module's Grant-ServiceControlPermission or Grant-ServicePermission functions. (DISCLAIMER: I am the owner/maintainer of the Carbon project.)

Figured it out. You have to use UNC paths to copy from remote sources and running as a local service. Apparently, this was answered on stackoverflow:

From http://msdn.microsoft.com/en-us/library/ms685143.aspx:

A service (or any process running in a different security context) that must access a remote resource should use the Universal Naming Convention (UNC) name to access the resource. The service must have appropriate privileges to access the resource. If a server-side service uses an RPC connection, delegation must be enabled on the remote server.

Drive letters are not global to the system. Each logon session receives its own set of drive letters from A to Z. Therefore, redirected drives cannot be shared between processes running under different user accounts. Moreover, a service (or any process running within its own logon session) cannot access the drive letters that were established within a different logon session.

A service should not directly access local or network resources through mapped drive letters, nor should it call the net use command to map drive letters at run time.

Drive letters won't work. So if you're coping files from wedav/https, with ssl enabled, you have to map the source using UNC:

net use https://test.net/plugins/servlet/confluence/default /user:user passwd

Then when you exec 'net use' you will see the following:

C:\Users\Administrator\test>net use
New connections will be remembered.


Status       Local     Remote                    Network

-------------------------------------------------------------------------------
                       \\test.net@SSL\plugins\servlet\conf
luence\default
                                                Web Client Network
The command completed successfully.

I used robo copy to copy from the UNC:

robocopy \\test.ney@SSL\plugins\servlet\confluence\default . /z /e