Querying Service Status with ADSI - what rights are needed?

Question

I'm using VB6 and using ADSI to query for the status (running or not) of a Windows Service. See this MS article: http://msdn.microsoft.com/en-us/library/aa746322(v=vs.85).aspx.

With a user who is a member of the USERS group, I'm receiving a thrown exception. I believe it's on the GetObject method:

Set comp = GetObject("WinNT://.,Computer")

The exception is: 80070005 "General access denied error"

Running the same code as a member of POWER USERS, however, works just fine.

Elevating all users to Power users isn't an option. What exact rights do I need to have granted in order for this function to run successfully?

I've tried running procmon.exe, and wasn't able to determine from the output as to what or where a denial is occurring.

Thanks!

Edit: This is running on XP sp2.

score 2 · Accepted Answer · answered Mar 23 '11 at 06:21

2

Sounds like you're running into a UAC barrier. I'm not familiar with IADsService, but it is hardly necessary in determining if a Windows service is running. Have you considered using API functions to query your service? Try QueryServiceStatus on a service opened with SERVICE_QUERY_STATUS.

answered Mar 23 '11 at 06:21

Joe Jordan

2,372
2
17
20

My apologies, I should have included that this is on XP (edit to include this tidbit). Thanks for the link, I'll check into that interface (not sure why it didn't come up on my previous searches). – MarkL Mar 23 '11 at 13:23
Okay, just tested services on XP. Limited user accounts are members of the Users group and can query information from the running services, so ADSI is probably requesting too much info behind the scenes. FYI the built-in Guest account however cannot query service info, the best you can do there is get a list of running process names. I would recommend using API calls so you can better control the process. – Joe Jordan Mar 23 '11 at 22:46
Yup, works for me too. And I also noticed the Guest/User Account difference. Thanks! – MarkL Mar 24 '11 at 15:18

score 0 · Answer 2 · answered Mar 24 '11 at 22:33

There is no need for heavyweight administrative services or API calls. The Shell Automation interface has offered this for some time (Win2K or later, Shell32.dll v. 5.0 or later):

With CreateObject("Shell.Application")
    MsgBox .IsServiceRunning("MSMQ")
End With

Works fine for me without elevation.

Querying Service Status with ADSI - what rights are needed?

2 Answers2