Enable Windows Service Monitoring Permissions

If the non-administrator monitoring account cannot retrieve Windows service information because of insufficient permissions, follow these steps to grant service access without adding the account to the local Administrators group.

Note

Skip these steps if service monitoring already works with the existing account configuration. The example service permissions below include start and stop permissions, not just read/query access.

Retrieve the user SID of the user account from the monitored device.
Open Command Prompt in Administrator mode.
Run the following command to retrieve the user SID. Replace UserName with the user name for the user account:

    wmic useraccount where name="UserName" get name,sid

Example:

    wmic useraccount where name="apiuser" get name,sid

Note down the SID (for example, S-1-0-10-200000-30000000000-4000000000-500).
Retrieve the current SDDL for the SC Manager.
Run the following command to save the current SDDL for the SC Manager to CurrentSDDL.txt:

    sc sdshow clussvc > CurrentSDDL.txt

Edit CurrentSDDL.txt and copy the entire content. The SDDL will look like this:

    D:(A;;CC;;;AU)(A;;CCLCRPRC;;;IU)(A;;CCLCRPRC;;;SU)(A;;CCLCRPWPRC;;;SY)(A;;KA;;;BA)(A;;CC;;;AC)S:(AU;FA;KA;;;WD)(AU;OIIOFA;GA;;;WD)

Update the SDDL by creating a new snippet for the SID:

    (A;;CCLCRPWPRC;;;<SID of User>)

Example:

    (A;;CCLCRPWPRC;;;S-1-0-10-200000-30000000000-4000000000-500)

Place this snippet before S: in the original SDDL. The updated SDDL will look like this:

    D:(A;;CC;;;AU)(A;;CCLCRPRC;;;IU)(A;;CCLCRPRC;;;SU)(A;;CCLCRPWPRC;;;SY)(A;;KA;;;BA)(A;;CC;;;AC)(A;;CCLCRPWPRC;;;S-1-0-10-200000-30000000000-4000000000-500)S:(AU;FA;KA;;;WD)(AU;OIIOFA;GA;;;WD)

Execute the following command with the updated SDDL, replacing the example SID with the actual user SID:

    sc sdset clussvc D:(A;;CC;;;AU)(A;;CCLCRPRC;;;IU)(A;;CCLCRPRC;;;SU)(A;;CCLCRPWPRC;;;SY)(A;;KA;;;BA)(A;;CC;;;AC)(A;;CCLCRPWPRC;;;S-1-0-10-200000-30000000000-4000000000-500)S:(AU;FA;KA;;;WD)(AU;OIIOFA;GA;;;WD)