Why am I unable to operate on a Windows service or edit its registry entries despite me running as SYSTEM?

Question

I am trying to change the startup type (from auto to disabled) of a Windows service (happens to be the ZoneAlarm vsmon service) on Windows 7. The program sets permissions on the service such that only the SYSTEM account can make changes.

When I am running as administrator-equivalent for example, the following sc.exe command

sc config vsmon start= disabled

gives a permissions error. To work around this I launched a command prompt as the SYSTEM user using the psexec utility.

psexec -i -s -d cmd.exe

then I confirmed I was indeed running as SYSTEM:

whoami

which outputted:

nt authority\system

but I got the same permissions error.

Next I ran regedit from that same SYSTEM command prompt and verified that it was indeed running as SYSTEM:

Navigated to the service's key at HKLM\System\CurrentControlSet\Services\vsmon and tried to change the startup type value manually but again got a permissions error:

Finally as a test I added Everyone with Full Control but got the same error.

What gives?

Answer 1

I do not know for sure if Zone Alarm does this but I do know that ESET will install kernal mode drivers that monitor all I/O activity and prevent its own active monitoring system from being disabled (Remember, if it was easy for you to disable it then it would be easy for malware to disable it too). That kernal mode driver could be monitoring writes to the system registry and intercepting and blocking them, even if they came from the SYSTEM user.

Usually your only two options is disable the active monitoring through the GUI of Zone Alarm which wont stop the service but may speed things up (if that is why you are tying to disable the service), or uninstall the program completely.