wntSvc... Functions on XP/W2K/NT and Guest Accounts

Keywords:   wntSvc... Functions on XP/W2K/NT   guest account user

FYI:

If you are using the wntSvc*() functions to manage services under WinNT/Win2K/WinXP, you need to be aware of a change in how the security on the Service Control Manager [e.g. the SCM] has changed in WinXP.

Under WinNT/Win2K, you could connect to the SCM on a remote system even if you were running under the guest account. However, on WinXP this is no longer possible. The Guest account is not a normal user in that when you use it you are not considered to be logged on as a normal authenticated user. Instead, you are truly a guest on the system and only have access to resources with permissions granted to the well known group "Everyone". Under WinXP the security on the SCM has had permissions revoked for "Everyone" and permissions granted to "Authenticated Users". A processes logged on using the Guest account never gets the "Authenticated Users" SID in its access token so the Guest account can no longer be used to access the SCM.

If you were relying on using the guest account to access remote NT/2K systems when managing services then this will no longer work if you try to use it to manage the services on a remote WinXP system. It will be necessary to stop using the Guest account and to tighten up your system/network security by using a "real" user account.

The Microsoft KB article Q179249 documents this change.

Article ID:   W15208

File Created: 2002:09:05:13:50:36

Last Updated: 2002:09:05:13:50:36

Database Search

TechHome

wntSvc... Functions on XP/W2K/NT and Guest Accounts