Securing Truxton Services

Securing Truxton Services

To find out what the permissions are for a service, use the "sc sdshow" command:

sc sdshow Les
sc sdshow Truxton
sc sdshow TruxtonDatabase

On my machine, it produces this lovely string:

D:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)

You can use the Powershell ConvertFrom-SddlString command to convert it to something humanly readable.

ConvertFrom-SddlString -Sddl "D:(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)" | Foreach-Object {$_.DiscretionaryAcl}

A better way to begin to understand it is by adding spaces and new line:

D:
(A;;CC DC LC SW RP WP DT LO CR SD RC WD WO;;;BU)
(A;;CC LC SW RP WP DT LO CR RC;;;SY)
(A;;CC DC LC SW RP WP DT LO CR SD RC WD WO;;;BA)
(A;;CC LC SW LO CR RC;;;IU)
(A;;CC LC SW LO CR RC;;;SU)

The most common permissions to alter are DC, WD and WO. DC - Change Configuration (aka Write Data) WD - Change Permissions WO - Take Ownership

It looks like the BuiltIn Users is the culprit. Let's change the BU part to get rid of those:

(A;;CC LC SW RP WP DT LO CR SD RC;;;BU)

Start a command prompt as Administrator then:

sc sdset Les D:(A;;CCLCSWRPWPDTLOCRSDRC;;;BU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)
sc sdset Truxton D:(A;;CCLCSWRPWPDTLOCRSDRC;;;BU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)
sc sdset TruxtonDatabase D:(A;;CCLCSWRPWPDTLOCRSDRC;;;BU)(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)

Links

• Microsoft Guidlines