Finding Service Privileges

Get-Service can provide basic information about Windows services but won’t list the required privileges. Here is a small PowerShell function that accepts a service name and returns the service privileges:

function Get-ServicePrivilege
{
    
    param
    (
        [Parameter(Mandatory)]
        [string]
        $ServiceName
    )
    
    # find the service
    $Service = @(Get-Service -Name $ServiceName -ErrorAction Silent)
    # bail out if there is no such service
    if ($Service.Count -ne 1) 
    { 
        Write-Warning "$ServiceName unknown."
        return
    }
    
    # read the service privileges from registry
    $Path = 'HKLM:SYSTEMCurrentControlSetServices' +  $service.Name
    $Privs = Get-ItemProperty -Path $Path -Name RequiredPrivileges

    # output in custom object
    [PSCustomObject]@{
        ServiceName = $Service.Name
        DisplayName = $Service.DisplayName
        Privileges = $privs.RequiredPrivileges
    }
}
 
PS C:> Get-ServicePrivilege spooler

ServiceName DisplayName        Privileges                                                                            
----------- -----------        ----------                                                                            
spooler     Druckwarteschlange {SeTcbPrivilege, SeImpersonatePrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege...}



PS C:> Get-ServicePrivilege XboxGipSvc

ServiceName DisplayName                       Privileges                                                                                
----------- -----------                       ----------                                                                                
XboxGipSvc  Xbox Accessory Management Service {SeTcbPrivilege, SeImpersonatePrivilege, SeChangeNotifyPrivilege, SeCreateGlobalPrivilege} 
 

psconf.eu – PowerShell Conference EU 2019 – June 4-7, Hannover Germany – visit www.psconf.eu There aren’t too many trainings around for experienced PowerShell scripters where you really still learn something new. But there’s one place you don’t want to miss: PowerShell Conference EU – with 40 renown international speakers including PowerShell team members and MVPs, plus 350 professional and creative PowerShell scripters. Registration is open at www.psconf.eu, and the full 3-track 4-days agenda becomes available soon. Once a year it’s just a smart move to come together, update know-how, learn about security and mitigations, and bring home fresh ideas and authoritative guidance. We’d sure love to see and hear from you!

Twitter This Tip! ReTweet this Tip!

GD Star Rating
loading...