Windows® Internals, Sixth Edition, Part 1

In an Administrator command prompt, use the create command of the command-line tool Sc (service control) to create a service and a virtual account in which it will run. This example uses the “srvany” service from an earlier Windows Resource Kit:C:\Windows\system32>sc create srvany obj= "NT SERVICE\srvany" binPath= "d:\a\ test\srvany.exe" [SC] CreateService SUCCESS

The previous command created the service (in the registry and also in the service controller manager’s internal list) and also created the virtual service account. Now Run the Services MMC snap-in (services.msc), select the new service, and look at the Log On tab in the Properties dialog.

You can also use the service properties dialog to create a virtual service account for an existing service. To do so, change the account name to “NT SERVICE\servicename and clear both password fields. Note, however, that existing services might not run correctly under a virtual service account, because that account might not have access to files or other resources needed by the service.

If you run Process Explorer and view the Security tab in the Properties dialog boxes for a service that uses a virtual account, you can observe the virtual account name and its security ID (SID).

The virtual service account can appear in an access control entry for any object (such as a file) the service needs to access. If you open the Properties dialog’s Security tab for a file and create an ACL that references the virtual service account, you will find that the account name you typed (for example, NT SERVICE\srvany) is changed to simply the service name (srvany) by the Check Names function, and it appears in the access control list in this shortened form.

The virtual service account can be granted permissions (or user rights) via Group Policy. In this example, the virtual account for the srvany service has been granted the right to create a pagefile.

You won’t see the virtual service account in user administration tools like lusrmgr.msc because it is not stored in the SAM registry hive. However, if you examine the registry within the context of the built-in System account (as described previously), you will see evidence of the account in the HKLM\Security\Policy\Secrets key:C:\>psexec –s –i –d c:\windows\regedit.exe

Security Descriptors and Access Control

Tokens, which identify a user’s credentials, are only part of the object security equation. Another part of the equation is the security information associated with an object, which specifies who can perform what actions on the object. The data structure for this information is called a security descriptor. A security descriptor consists of the following attributes:

Revision number. The version of the SRM security model used to create the descriptor.

Flags. Optional modifiers that define the behavior or characteristics of the descriptor. These flags are listed in Table 6-5.

Owner SID. The owner’s security ID.

Group SID. The security ID of the primary group for the object (used only by POSIX).

Discretionary access control list (DACL). Specifies who has what access to the object.

System access control list (SACL). Specifies which operations by which users should be logged in the security audit log and the explicit integrity level of an object.

Table 6-5. Security Descriptor Flags

Flag

Meaning

SE_OWNER_DEFAULTED

Indicates a security descriptor with a default owner security identifier (SID). Use this bit to find all the objects that have default owner permissions set.

SE_GROUP_DEFAULTED

Indicates a security descriptor with a default group SID. Use this bit to find all the objects that have default group permissions set.

SE_DACL_PRESENT

Indicates a security descriptor that has a DACL. If this flag is not set, or if this flag is set and the DACL is NULL, the security descriptor allows full access to everyone.

SE_DACL_DEFAULTED

Indicates a security descriptor with a default DACL. For example, if an object creator does not specify a DACL, the object receives the default DACL from the access token of the creator. This flag can affect how the system treats the DACL, with respect to access control entry (ACE) inheritance. The system ignores this flag if the SE_DACL_PRESENT flag is not set.

SE_SACL_PRESENT

Indicates a security descriptor that has a system access control list (SACL).

SE_SACL_DEFAULTED

Indicates a security descriptor with a default SACL. For example, if an object creator does not specify an SACL, the object receives the default SACL from the access token of the creator. This flag can affect how the system treats the SACL with respect to ACE inheritance. The system ignores this flag if the SE_SACL_PRESENT flag is not set.

SE_DACL_UNTRUSTED