Folder with WRITE permission for a Windows Service and only READ permission for other apps

Question

I want to write some files from a Windows Service, and be able to read them from other apps. But I don't want other apps to be able to write to this folder.

Is there a standard folder for that (like there is App Data for storing data which does not have to be read from other apps)?

Answer 1

It is important to consider that Windows sets permissions to read and write files based on the user (or group he is member of) and the ACL entries in the file system. So "preventing other apps to write to this folder" is really "other apps which are started under a normal user".

You could place the service in a directory under

C:\Program Files,

e.g.

C:\Program Files\CompanyName\ServiceInstallDir

If the service runs under the local SYSTEM account, it has the permission to write to this folder. And normal users have only read access.

But be aware that this is not bullet-proof and you never know if someone with admin rights changes the permissions on your folder after the install.

I would only do it this way if I had control over the system and the other apps (e.g. in a corporate infrastructure with Active Directory and all machines in a domain).

Be also aware that "other apps" could also be Windows services running under SYSTEM or another user with local admin rights, so they would also be able to write to your folder.

Another solution would be to run the service under a dedicated user account (either local or Active Directory), and set the permission of your folder so that only this user has modify rights.

Please note that you have to give this user account the privilege "Log on as service" (via Local Security Policy or AD GPO).

But even in this case: if some other (admin) user has Restore Privileges, he could circumvent the ACL.

Another important note:

Running the service under SYSTEM means that this service is highly privileged, which may be a security risk.

---

Important note from eryksun (see comments) Thank you !

See also https://blogs.technet.microsoft.com/voy/2007/03/22/per-service-sid/

So you can prevent other services to write to your files.