{"id":111440,"date":"2025-08-06T07:00:00","date_gmt":"2025-08-06T14:00:00","guid":{"rendered":"https:\/\/devblogs.microsoft.com\/oldnewthing\/?p=111440"},"modified":"2025-08-06T11:01:08","modified_gmt":"2025-08-06T18:01:08","slug":"20250806-00","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/oldnewthing\/20250806-00\/?p=111440","title":{"rendered":"How do I disable pieces of the property sheet for a service in the Services MMC snap-in?"},"content":{"rendered":"<p>A customer was developing a service, and they didn&#8217;t want users to be able to change the service&#8217;s startup type (e.g. change it from auto-start to disabled). They saw that other services had the &#8220;Startup type&#8221; field disabled. How can they get in on that action? They found that that they could get close to the desired behavior by restricting the ACLs on the service registry key. That doesn&#8217;t disable the startup type combo box in the UI, but it did mean that when the user tried to change the setting, they got an error message.<\/p>\n<p>There is no need to do any undocumented hacking to get the desired effect. It&#8217;s all right there in front of you.<\/p>\n<p>To prevent users from being able to change the startup type, don&#8217;t grant them <code>SERVICE_<wbr \/>CHANGE_<wbr \/>CONFIG<\/code> access to the service. The &#8220;Startup type&#8221; combo box disables itself if the user does not have permission to change the service configuration.<\/p>\n<p>Use the <code>Set\u00adService\u00adObject\u00adSecurity<\/code> function to change the access control list for a service. There is a sample program in the documentation: <a title=\"Modifying the DACL for a Service\" href=\"https:\/\/learn.microsoft.com\/en-us\/windows\/win32\/services\/modifying-the-dacl-for-a-service\"> Modifying the DACL for a Service<\/a>.<\/p>\n<p>Similarly, you can control who can start and stop the service by adjusting who gets <code>SERVICE_<wbr \/>START<\/code>, <code>SERVICE_<wbr \/>STOP<\/code>, and <code>SERVICE_<wbr \/>PAUSE_<wbr \/>CONTINUE<\/code> access to the service.<\/p>\n<p><b>Bonus chatter<\/b>: For every immovable object, there is a more motivated unstoppable force: My friends over in support tell me that they sometimes get cases where they discover that a system-provided service has been configured in some way that shouldn&#8217;t be possible, given that the option is disabled in the UI. Upon closer questioning, the customer explains, &#8220;Yeah, it was disabled in the UI, so we had to do \u27e6really extreme thing\u27e7 to get that service reconfigured the way we want it.&#8221;<\/p>\n<p>This is like driving up to a bridge, seeing a &#8220;Bridge out of order&#8221; sign, then getting out of your car, moving the sign, driving onto the bridge, falling into the river, and then complaining to the car manufacturer that their car doesn&#8217;t work.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>There&#8217;s no secret setting. It&#8217;s all based on access control.<\/p>\n","protected":false},"author":1069,"featured_media":111744,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[25],"class_list":["post-111440","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oldnewthing","tag-code"],"acf":[],"blog_post_summary":"<p>There&#8217;s no secret setting. It&#8217;s all based on access control.<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/111440","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/users\/1069"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/comments?post=111440"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/posts\/111440\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media\/111744"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/media?parent=111440"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/categories?post=111440"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/oldnewthing\/wp-json\/wp\/v2\/tags?post=111440"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}