windowswindows-server-2016windows-service
I have following script:
cmdkey.exe /add:COMPUTER /user:COMPUTER\user /pass:somepassword
sc \\COMPUTER stop Servicename
Works fine with Windows 2012 R2 but not with Windows 2016. With windows 2016 I get this error: [SC] OpenService FAILED 5: Access is denied.
User is admin. If I log to COMPUTER with User and run this command – it works.
If I run this command remotely from some domain account – it works.
Same problem with alternative command:
psservice \\COMPUTER -accepteula stop Servicename
Thanks to Craig620, the problem was indeed related to the security descriptor.
C:>sc sdshow "flexnet licensing service"
D:(D;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;NU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCLCSWRPLOCRRC;;;IU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
C:>sc sdshow myService
D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
And from the SID syntax we can see the first entry ((D;;...;;;NU)) Disables most permissions for anything coming over the network (NU). When I changed the SD to have the same permissions minus the NU disablement, I could query and delete the service remotely using the sc.exe command.
Best Answer
assuming the admin account is a local account you are probably encountering remote UAC.