Question about Services

Can I start a Service and restrict it to a group of user so you can only
start it if you are a part of that group? and can I create that group with my
MSI package?

MFD <MFD@discussions.microsoft.com> writes:

> Can I start a Service and restrict it to a group of user so you can only
> start it if you are a part of that group?

Yes you can. You'd give the service a security descriptor whose
DACL grants SERVICE_START to the group. However, the
LockPermissions table of Windows Installer does not support
services, so you would need a custom action to set the security
descriptor. WiX apparently comes with such a custom action.

Alternatively, it might be possible to set the security
descriptor via the Registry table. However, I don't know if the
affected registry key is really documented, and it might even be
under Windows Resource Protection in Vista, so I do not recommend
this.

> and can I create that group with my MSI package?

Windows Installer does not itself support creating groups,
but WiX includes a custom action for that purpose, so apparently
it can be done.

Hi,

On Fri, 10 Oct 2008 06:25:01 -0700, MFD <MFD@discussions.microsoft.com> wrote:

>Can I start a Service and restrict it to a group of user so you can only
>start it if you are a part of that group? and can I create that group with my
>MSI package?


"SC.EXE" (and probably others) can do this (you'd need a custom action):

http://makemsi-manual.dennisbareis.c...ated_tools.htm

Bye,
Dennis
Dennis Bareis [Microsoft MVP] (dbareis@KillSpam.gmail.com)
http://dennisbareis.com/
Freeware Windows Installer creation tool (+ "ORCA automation"):
http://makemsi.dennisbareis.com/