0

I'm writing a Windows Service that occasionally queries data in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Profiles, to detect if the system has changed network (e.g. it's a laptop and they connect to a new Wifi Hotspot).

The Service must run as a LocalService account, so has no administration privileges, however the read permissions on this particular key and its subkeys are for Administrators ony, so the LocalService account is not able to read them.

I'd like to manually add read permissions for my Service to the key, but ONLY for that one Service. I could grant the "Local Service" account read privileges, but this would allow all LocalService Services to read the key, which I do not want. Is there any way of doing this, maybe creating a user account for a single application?

ajq88
  • 305
  • 1
  • 14

1 Answers1

2

Vista added Service Isolation and it can assign a service SID to the process. You can then add this SID to the ACL of the registry key.

Community
  • 1
  • 1
Anders
  • 97,548
  • 12
  • 110
  • 164