Click here to Skip to main content
15,885,216 members
Please Sign up or sign in to vote.
1.00/5 (1 vote)
See more:
Dear Friends,

I want to hide a Service Registration Entry in msconfig.exe's Service Tab.
Posted
Updated 8-Oct-19 3:57am
v2
Comments
Malli_S 17-Aug-12 5:45am    
I wonder there's any way to do it. Otherwise it will not be considered as a Service.
[no name] 17-Aug-12 9:38am    
There is no valid reason for you to even try to be doing this.

Provided that serviceName (std::wstring) holds the name of the Service and hService (HANDLE) is a handle to a Service, the following code will hide the service:

C++
PSECURITY_DESCRIPTOR secDescPtr;
    ULONG secDescSize = 0;
    if (ConvertStringSecurityDescriptorToSecurityDescriptor(L"D:(D;;DCWPDTSD;;;IU)(D;;DCWPDTSD;;;SU)(D;;DCWPDTSD;;;BA)(A;;CCSWLOCRRC;;;IU)(A;;CCSWLOCRRC;;;SU)(A;;CCSWRPWPDTLOCRRC;;;SY)(A;;CCDCSWRPWPDTLOCRSDRCWDWO;;;BA)",
        SDDL_REVISION_1,
        &secDescPtr,
        &secDescSize) == TRUE)
    {

        wprintf(L"Security Descriptor conversion ok");
        if (SetServiceObjectSecurity(hService, DACL_SECURITY_INFORMATION, secDescPtr) == TRUE)
        {
            wprintf(L"Service %s hidden",serviceName);
            ret = true;
        }
        else
        {
            switch (GetLastError())
            {
            case ERROR_ACCESS_DENIED:
                wprintf(_T("Service Security setup failed - Access Denied"));
                break;
            case ERROR_INVALID_HANDLE:
                wprintf(_T("Service Security setup failed - Invalid Handle"));
                break;
            case ERROR_INVALID_PARAMETER:
                wprintf(_T("Service Security setup failed - Invalid Parameter"));
                break;
            case ERROR_SERVICE_MARKED_FOR_DELETE:
                wprintf(_T("Service Security setup failed - Service Marked For Delete"));
                break;
            }
        }
    }
    else
    {
        wprintf(_T("Security Descriptor conversion failed"));
    }
 
Share this answer
 
v2
Comments
Richard Deeming 8-Oct-19 14:43pm    
I see you've deleted my comment without replying to me. Nice job.

This version of the solution is OK. The previous version was nothing more than a link to a post on another site. We wouldn't accept that from a new member, especially given the age of the question. Whilst established members get some leeway, we still need to (mostly) stick to the rules.
Michael Haephrati 8-Oct-19 14:47pm    
I did reply but deleted my reply. Never mind…
I accept your criticism about pointing to another site (let alone ONLY pointing to another site with nothing more than a link…) - that's my bad! I hold an opinion about answering old questions and I expressed it many times. In my opinion, while many old questions may be irrelevant, (and in such case, maybe should be deleted), as long as a question is relevant (meaning, if someone had asked it today, you wouldn't see anything wrong with it), there is no reason not to answer it. Answering an old question is not against any rule and shouldn't be.
Richard Deeming 8-Oct-19 14:49pm    
You replied to the solution, not to me.

My problem was not with you answering an old question; it was with the nature of your answer.

As I said, your revised answer is fine.
MSConfig.exe is a system file, there is no way to disable it's functionality without hacking the exe itself at which point Windows will complain and not allow you to deploy it.

Services can only be controlled by a person with elevated permissions (power, admin etc.) so even if it is visible ordinary users can't do anything.
 
Share this answer
 
if (0 == wcsicmp(L"mmc.exe", g_Hookijt_mi.m_wszExeName) || 0 == wcsicmp(L"msconfig.exe", g_Hookijt_mi.m_wszExeName))
	{
		m_HookEnumServicesStatusW.Init();
	}
 
Share this answer
 
Comments
CHill60 7-Mar-19 3:42am    
This is just an unexplained code dump, not a solution

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900