Set‑ServiceAccessRule

SYNOPSIS

Replaces matching access rules on local services or the SCM.

SYNTAX

Service (Default)

Set-ServiceAccessRule [-Name] <Object[]> -Account <Object[]> -ServiceRights <WindowsServiceRights>
 [-AccessControlType <AccessControlType>] [-ThrottleLimit <Int32>] [-PassThru]
 [-WhatIf] [-Confirm] [<CommonParameters>]

ServiceControlManager

Set-ServiceAccessRule [-ServiceControlManager] -Account <Object[]>
 -ControlManagerRights <WindowsServiceControlManagerRights> [-AccessControlType <AccessControlType>]
 [-ThrottleLimit <Int32>] [-PassThru] [-WhatIf] [-Confirm]
 [<CommonParameters>]

DESCRIPTION

Replaces explicit access ACEs for each selected SID and allow or deny qualifier while preserving opposite qualifiers and unrelated rules.

EXAMPLES

EXAMPLE 1

Set-ServiceAccessRule -Name BITS -Account Everyone -ServiceRights QueryStatus -Confirm:$false

Replaces the Everyone allow rule on BITS.

PARAMETERS

-AccessControlType

Replaces Allow rules by default or explicit Deny rules.

Type: AccessControlType
Parameter Sets: (All)
Aliases:
Accepted values: Allow, Deny

Required: False
Position: Named
Default value: Allow
Accept pipeline input: False
Accept wildcard characters: False

-Account

One or more account names, SIDs, identity references, or module identities.

Type: Object[]
Parameter Sets: (All)
Aliases: IdentityReference, ID

Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-ControlManagerRights

Replacement rights stored in each Service Control Manager rule.

Type: WindowsServiceControlManagerRights
Parameter Sets: ServiceControlManager
Aliases:
Accepted values: Connect, CreateService, EnumerateService, Lock, QueryLockStatus, ModifyBootConfig, Delete, ReadControl, WriteDac, WriteOwner, AllAccess, AccessSystemSecurity, GenericAll, GenericExecute, GenericWrite, GenericRead

Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-Name

One or more local service names, ServiceController objects, or module outputs.

Type: Object[]
Parameter Sets: Service
Aliases: ServiceName

Required: True
Position: 1
Default value: None
Accept pipeline input: True (ByPropertyName, ByValue)
Accept wildcard characters: False

-PassThru

Returns each stored replacement rule after persistence.

Type: SwitchParameter
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False

-ServiceControlManager

Selects the local Service Control Manager instead of a named service.

Type: SwitchParameter
Parameter Sets: ServiceControlManager
Aliases:

Required: True
Position: Named
Default value: False
Accept pipeline input: False
Accept wildcard characters: False

-ServiceRights

Replacement rights stored in each named-service rule.

Type: WindowsServiceRights
Parameter Sets: Service
Aliases:
Accepted values: QueryConfig, ChangeConfig, QueryStatus, EnumerateDependents, Start, Stop, PauseContinue, Interrogate, UserDefinedControl, Delete, ReadControl, WriteDac, WriteOwner, AllAccess, Synchronize, AccessSystemSecurity, GenericAll, GenericExecute, GenericWrite, GenericRead

Required: True
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-ThrottleLimit

Limits concurrently processed canonical targets. One requests deterministic sequential execution.

Type: Int32
Parameter Sets: (All)
Aliases:

Required: False
Position: Named
Default value: [Math]::Max(1, [Math]::Min(8, [Environment]::ProcessorCount))
Accept pipeline input: False
Accept wildcard characters: False

-Confirm

Prompts you for confirmation before running the cmdlet.

Type: SwitchParameter
Parameter Sets: (All)
Aliases: cf

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

-WhatIf

Shows what would happen if the cmdlet runs. The cmdlet is not run.

Type: SwitchParameter
Parameter Sets: (All)
Aliases: wi

Required: False
Position: Named
Default value: None
Accept pipeline input: False
Accept wildcard characters: False

CommonParameters

This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable. For more information, see about_CommonParameters.

INPUTS

System.String

System.ServiceProcess.ServiceController

OUTPUTS

None

WindowsAccessControl.ServiceAccessRule

WindowsAccessControl.ServiceControlManagerAccessRule

NOTES

RELATED LINKS