Get-Service can provide basic information about Windows services but won’t list the required privileges. Here is a small PowerShell function that accepts a service name and returns the service privileges:

function Get-ServicePrivilege
{
    
    param
    (
        [Parameter(Mandatory)]
        [string]
        $ServiceName
    )
    
    # find the service
    $Service = @(Get-Service -Name $ServiceName -ErrorAction Silent)
    # bail out if there is no such service
    if ($Service.Count -ne 1) 
    { 
        Write-Warning "$ServiceName unknown."
        return
    }
    
    # read the service privileges from registry
    $Path = 'HKLM:\SYSTEM\CurrentControlSet\Services\' +  $service.Name
    $Privs = Get-ItemProperty -Path $Path -Name RequiredPrivileges

    # output in custom object
    [PSCustomObject]@{
        ServiceName = $Service.Name
        DisplayName = $Service.DisplayName
        Privileges = $privs.RequiredPrivileges
    }
}
 
PS C:\> Get-ServicePrivilege spooler

ServiceName DisplayName        Privileges                                                                            
----------- -----------        ----------                                                                            
spooler     Druckwarteschlange {SeTcbPrivilege, SeImpersonatePrivilege, SeAuditPrivilege, SeChangeNotifyPrivilege...}



PS C:\> Get-ServicePrivilege XboxGipSvc

ServiceName DisplayName                       Privileges                                                                                
----------- -----------                       ----------                                                                                
XboxGipSvc  Xbox Accessory Management Service {SeTcbPrivilege, SeImpersonatePrivilege, SeChangeNotifyPrivilege, SeCreateGlobalPrivilege} 
 

psconf.eu – PowerShell Conference EU 2019 – June 4-7, Hannover Germany – visit www.psconf.eu There aren’t too many trainings around for experienced PowerShell scripters where you really still learn something new. But there’s one place you don’t want to miss: PowerShell Conference EU - with 40 renown international speakers including PowerShell team members and MVPs, plus 350 professional and creative PowerShell scripters. Registration is open at www.psconf.eu, and the full 3-track 4-days agenda becomes available soon. Once a year it’s just a smart move to come together, update know-how, learn about security and mitigations, and bring home fresh ideas and authoritative guidance. We’d sure love to see and hear from you!

Twitter This Tip! ReTweet this Tip!

Anonymous