将Windows Service应用程序配置为不能由用户编辑

Question

我有一个Windows服务应用程序，该应用程序安装在用户计算机上，并显示在“服务”页面（services.msc）下。我希望启动选项不能由用户（通过“服务UI”）配置，如下面的屏幕快照所示（与Windows Defender Antivirus Service一样）：

提前感谢。

Answer 1

@@ RbMm是正确的。

以下是在C ++中使用winapi的示例。

#include <windows.h>
#include <sddl.h>

#pragma comment(lib, "Advapi32")

int main()
{
    SC_HANDLE sHdl = OpenSCManager(NULL, SERVICES_ACTIVE_DATABASE, SC_MANAGER_ALL_ACCESS);
    if (sHdl == NULL)
        printf("OpenSCManager error: %d\n", GetLastError());

    SC_HANDLE serviceHdl = OpenService(sHdl, L"MyTestDirectXService", READ_CONTROL | WRITE_OWNER | WRITE_DAC);
    if (sHdl == NULL)
        printf("OpenService error: %d\n", GetLastError());

    char buf[1024];
    DWORD retLen = 0;

    // ### Query
    if(!QueryServiceObjectSecurity(serviceHdl, OWNER_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION, buf, sizeof(buf), &retLen))
        printf("QueryServiceObjectSecurity error: %d\n", GetLastError());

    LPWSTR strBuf = NULL;
    unsigned long strLen = 0;
    if (!ConvertSecurityDescriptorToStringSecurityDescriptor(buf, SDDL_REVISION_1, OWNER_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION, &strBuf, &strLen))
        printf("ConvertSecurityDescriptorToStringSecurityDescriptor error: %d\n", GetLastError());

    wprintf(strBuf);

    // ### Set
    PSECURITY_DESCRIPTOR sDescriptor = {0};
    if(!ConvertStringSecurityDescriptorToSecurityDescriptor(L"O:BAD:(A;;GA;;;SY)(A;;GRGX;;;IU)", SDDL_REVISION_1, &sDescriptor, NULL))
        printf("ConvertStringSecurityDescriptorToSecurityDescriptor error: %d\n", GetLastError());

    if (!SetServiceObjectSecurity(serviceHdl, OWNER_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION, sDescriptor))
        printf("SetServiceObjectSecurity error: %d\n", GetLastError());

    // ### Check
    if (!QueryServiceObjectSecurity(serviceHdl, OWNER_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION, buf, sizeof(buf), &retLen))
        printf("QueryServiceObjectSecurity error: %d\n", GetLastError());

    strBuf = NULL;
    strLen = 0;
    if (!ConvertSecurityDescriptorToStringSecurityDescriptor(buf, SDDL_REVISION_1, OWNER_SECURITY_INFORMATION | DACL_SECURITY_INFORMATION, &strBuf, &strLen))
        printf("ConvertSecurityDescriptorToStringSecurityDescriptor error: %d\n", GetLastError());

    wprintf(strBuf);

    getchar();
}

运行上述代码后，开始选项将被禁用，如下所示：