How to reset service permissions after messing up with `sc sdset`?

Question

After applying this "solution" I have no way of starting the spooler service, not even as Admin.

If I open services.msc as Administrator, that service has disappeared, as noted here (I wish I found that before).

How can I reset permissions for the spooler service?

http://systemoverload.net/2010/12/14/how-to-reset-windows-service-sddl-acl — joeqwerty, Nov 20 '14 at 16:28

score 7 · Accepted Answer · answered Nov 21 '14 at 07:35

The SYSTEM security context can reset it. You don't mention your Windows version, but in Windows Server 2008 and newer versions it can be a bit difficult to get a SYSTEM command prompt. It's very easy, though, to get the "Task Scheduler" in all versions of Windows to run a command as SYSTEM.

Dump the security descriptor from a known-good machine using the sc sdshow spooler command.
Create a scheduled task on the broken machine to run the command %SystemRoot%\system32\sc.exe with the arguments sdset spoooler <paste good security descriptor here>.
Set the task to run as SYSTEM
Manually run the task

Your service's security descriptor will be restored to normal.

I found easier [to use `PsExec`](http://cloud.kemta.net/2013/01/resetting-the-discretionary-access-control-list-dacl-in-a-windows-service-security-descriptor/). The full command was `PsExec.exe /s sc sdset spooler D:(A;;CCLCSWLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SY)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)`. — Yajo, Nov 21 '14 at 08:27

score 0 · Answer 2 · answered Nov 08 '17 at 00:33

0

In addition to Evan's Task Scheduler method, I also had to

Remove the following registry key (folder)

HKLM\SYSTEM\CurrentControlSet\Control\ServiceGroupOrder\Security

Reboot the server

answered Nov 08 '17 at 00:33

KERR

365
3
8

How to reset service permissions after messing up with `sc sdset`?

2 Answers2

Linked