Modifying service control permissions in a Windows MSI installer

Question

So right now I'm trying to change permissions on a windows service by using the command: sc sdset SERVICENAME PERMISSIONS

I have placed this in an MSI installer as an action and it seems to execute fine. However, sc requires administrator privlidges to set the permissions and I cannot seem to find a way to do that within the MSI installer. I tried using the command runas /user:administrator but unfortunatley this could be different on the machines the installer is going to run on.

Any tips?

Answer 1

To run a custom action with full privileges you can mark it as deferred with no impersonation. This is done differently in each setup authoring tool, so you need to be more specific about what you are using if you want more details.

The basic settings are:

• schedule the custom action between InstallInitialize and InstallFinalize actions in InstallExecuteSequence table
• set msidbCustomActionTypeInScript and msidbCustomActionTypeNoImpersonate flags in Type column from CustomAction table

This way your custom action will run under the local SYSTEM account with full privileges.