Securing Truxton Services

Securing Truxton Services

To find out what the permissions are for a service, use the "sc sdshow" command:

sc sdshow Les
sc sdshow Truxton
sc sdshow TruxtonDatabase

On my machine, it produces this lovely string:

D:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)

You can use the Powershell ConvertFrom-SddlString command to convert it to something humanly readable.

ConvertFrom-SddlString -Sddl "D:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)" | Foreach-Object {$_.DiscretionaryAcl}

A better way to begin to understand it is by adding spaces and new line:

D:
(A;;CC DC LC SW RP WP DT LO CR SD RC WD WO;;;BU)
(A;;CC LC SW RP WP DT LO CR RC;;;SY)
(A;;CC DC LC SW RP WP DT LO CR SD RC WD WO;;;BA)
(A;;CC LC SW LO CR RC;;;IU)
(A;;CC LC SW LO CR RC;;;SU)

The most common permissions to alter are DC, WD and WO.

Code	Meaning
DC	Change Configuration (aka Write Data)
WD	Change Permissions (aka Write Descriptor)
WO	Take Ownership (aka Write Owner)

It looks like the BuiltIn Users is the culprit. Let's change the BU part to get rid of those:

(A;;CC LC SW RP WP DT LO CR SD RC;;;BU)

Start a command prompt as Administrator then:

sc sdset Les D:(A;;CCLCSWRPWPDTLOCRSDRC;;;BU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)
sc sdset Truxton D:(A;;CCLCSWRPWPDTLOCRSDRC;;;BU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)
sc sdset TruxtonDatabase D:(A;;CCLCSWRPWPDTLOCRSDRC;;;BU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)

Links

• Microsoft Guidlines