Mirrors
/
nssm
mirror of http://git.nssm.cc/nssm/nssm.git
2
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
master
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '6500f75954'
${ noResults }
nssm/account.h

24 lines
852 B
C
Raw Normal View History Unescape Escape

Handle well-known account names. Certain well-known accounts can be used to start a service without entering a password. "LocalSystem" is the default value of ObjectName in the registry. It is not a real account but is an alias for the "NT Authority\System" account. "NT Authority\Local Service" has minimal local and no network privileges. "NT Authority\Network Service" has minimal local and network privileges. NSSM now recognises these well-known accounts and will accept them as ObjectName parameters without complaining that no password was enter. With the exception of LocalSystem, each can be specified without the "NT Authority" pseudo-domain prefix.
11 years ago
#ifndef ACCOUNT_H
#define ACCOUNT_H
#include <ntsecapi.h>
/* Not really an account. The canonical name is NT Authority\System. */
#define NSSM_LOCALSYSTEM_ACCOUNT _T("LocalSystem")
Use well-known account aliases. Jump through a few hoops to make the Windows service control panel to localise service ObjectNames if they are set to LocalSystem, LocalService or NetworkService. Those aren't the canonical names of the accounts as returned by LsaLookupSids() so attempting to call ChangeServiceConfig() with a username of, eg, NetworkService will fail, even though writing NetworkService directly to the registry would work. Calling ChangeServiceConfig() with a username of "NT Authority\Network Service" will work, since that's the canonical name returned by LsaLookupSids() but it won't be localised in the control panel. The solution is to write "NT Authority\NetworkService" to the registry and it will appear correctly. At this point I'm not sure whether to label it a bug or a feature that "nssm get <service> ObjectName" will return the actual value in the registry and not the localised name. Thanks Marco Certelli.
11 years ago
/* Other well-known accounts which can start a service without a password. */
#define NSSM_LOCALSERVICE_ACCOUNT _T("NT Authority\\LocalService")
#define NSSM_NETWORKSERVICE_ACCOUNT _T("NT Authority\\NetworkService")
Handle well-known account names. Certain well-known accounts can be used to start a service without entering a password. "LocalSystem" is the default value of ObjectName in the registry. It is not a real account but is an alias for the "NT Authority\System" account. "NT Authority\Local Service" has minimal local and no network privileges. "NT Authority\Network Service" has minimal local and network privileges. NSSM now recognises these well-known accounts and will accept them as ObjectName parameters without complaining that no password was enter. With the exception of LocalSystem, each can be specified without the "NT Authority" pseudo-domain prefix.
11 years ago
/* This is explicitly a wide string. */
#define NSSM_LOGON_AS_SERVICE_RIGHT L"SeServiceLogonRight"
int open_lsa_policy(LSA_HANDLE *);
int username_sid(const TCHAR *, SID **, LSA_HANDLE *);
int username_sid(const TCHAR *, SID **);
int username_equiv(const TCHAR *, const TCHAR *);
int is_localsystem(const TCHAR *);
Use well-known account aliases. Jump through a few hoops to make the Windows service control panel to localise service ObjectNames if they are set to LocalSystem, LocalService or NetworkService. Those aren't the canonical names of the accounts as returned by LsaLookupSids() so attempting to call ChangeServiceConfig() with a username of, eg, NetworkService will fail, even though writing NetworkService directly to the registry would work. Calling ChangeServiceConfig() with a username of "NT Authority\Network Service" will work, since that's the canonical name returned by LsaLookupSids() but it won't be localised in the control panel. The solution is to write "NT Authority\NetworkService" to the registry and it will appear correctly. At this point I'm not sure whether to label it a bug or a feature that "nssm get <service> ObjectName" will return the actual value in the registry and not the localised name. Thanks Marco Certelli.
11 years ago
const TCHAR *well_known_sid(SID *);
const TCHAR *well_known_username(const TCHAR *);
Handle well-known account names. Certain well-known accounts can be used to start a service without entering a password. "LocalSystem" is the default value of ObjectName in the registry. It is not a real account but is an alias for the "NT Authority\System" account. "NT Authority\Local Service" has minimal local and no network privileges. "NT Authority\Network Service" has minimal local and network privileges. NSSM now recognises these well-known accounts and will accept them as ObjectName parameters without complaining that no password was enter. With the exception of LocalSystem, each can be specified without the "NT Authority" pseudo-domain prefix.
11 years ago
int grant_logon_as_service(const TCHAR *);
#endif