Controlling a service using ServiceController versus using services.msc, with UAC enabled

Question

I'm working on an application that manages services that make up some product. Up to now, it was foreseen that this application was started with elevation (so the user had to confirm a UAC prompt). It appeared that for most operations, elevation was not needed, like starting an stopping services.

The application normally will be run by a member of the local Administrators group; these people can start services.msc, and they can then start and stop services. So I expected it to "just work":

ServiceController sc = new ServiceController(Environment.MachineName, "MyServiceApp");
sc.Start();

It fails with an "access denied" exception. So I added

ServiceControllerPermission scp = 
    new ServiceControllerPermission(ServiceControllerPermissionAccess.Control, Environment.MachineName, "MyServiceApp");
scp.Demand();
ServiceController sc = new ServiceController(Environment.MachineName, "MyServiceApp");
sc.Start();

The Demand succeeds, the Start still fails.

I read a lot of questions (and answers) on issues with ServiceController and security on StackExchange; a lot of the answers suggest elevation is needed. Since I (I am member of the local Administrators group) can just start and stop using services.msc, just don't buy it.

So what's up with services.msc - and what's up with my code ? I do have UAC enabled and I don't want to disable it. To start or stop a service, no elevation is needed, right ? Otherwise services.msc would need elevation too ? (a colleague of mine suggested services.msc contained some 'special code' that 'made it work'; I don't buy that either).

Thanks for any answers.

Answer 1

Services.msc (the mmc.exe) is not necessarily running with elevated/administrative privileges.

You can make some "special code" that asks Windows to run your program run as elevated. You'll use a manifest file.

How do I force my .NET application to run as administrator? https://stackoverflow.com/a/4084620/787893