如何为非管理员用户配置Print Spooler服务的启停权限（支持任意语言）

要让非管理员用户能启停Print Spooler服务，核心是修改该服务的安全访问控制列表（ACL），给目标用户分配SERVICE_START、SERVICE_STOP和SERVICE_QUERY_STATUS权限。注意：执行此操作的程序必须以管理员身份运行，否则没有修改服务权限的权限。

C# WinForms实现步骤 #

1. 配置程序提权 #

在WinForms项目中添加app.manifest文件，将requestedExecutionLevel设置为requireAdministrator，确保程序启动时请求管理员权限：

<requestedExecutionLevel level="requireAdministrator" uiAccess="false" />

2. 核心权限修改代码 #

通过P/Invoke调用Windows API直接操作服务的安全描述符，以下是按钮点击事件的完整实现：

using System;
using System.Security.Principal;
using System.Windows.Forms;
using System.Runtime.InteropServices;
using System.Security.AccessControl;

public partial class MainForm : Form
{
    // Windows API声明
    [DllImport("advapi32.dll", SetLastError = true, CharSet = CharSet.Auto)]
    private static extern IntPtr OpenService(IntPtr hSCManager, string lpServiceName, uint dwDesiredAccess);

    [DllImport("advapi32.dll", SetLastError = true)]
    private static extern IntPtr OpenSCManager(string lpMachineName, string lpDatabaseName, uint dwDesiredAccess);

    [DllImport("advapi32.dll", SetLastError = true)]
    private static extern bool QueryServiceObjectSecurity(IntPtr hService, int securityInformation, IntPtr pSecurityDescriptor, uint nLength, out uint lpnLengthNeeded);

    [DllImport("advapi32.dll", SetLastError = true)]
    private static extern bool SetServiceObjectSecurity(IntPtr hService, int securityInformation, IntPtr pSecurityDescriptor);

    [DllImport("advapi32.dll", SetLastError = true)]
    private static extern bool CloseServiceHandle(IntPtr hSCObject);

    // 常量定义
    private const uint SC_MANAGER_CONNECT = 0x0001;
    private const uint SERVICE_CHANGE_CONFIG = 0x0002;
    private const int DACL_SECURITY_INFORMATION = 0x00000004;
    private const int SERVICE_START = 0x00000001;
    private const int SERVICE_STOP = 0x00000002;
    private const int SERVICE_QUERY_STATUS = 0x00000004;

    public MainForm()
    {
        InitializeComponent();
    }

    private void btnAddPermission_Click(object sender, EventArgs e)
    {
        // 获取输入的用户名（格式：DOMAIN\Username 或 .\Username 本地用户）
        string userName = txtUserName.Text.Trim();
        if (string.IsNullOrEmpty(userName))
        {
            MessageBox.Show("请输入要添加权限的用户名");
            return;
        }

        IntPtr scManager = OpenSCManager(null, null, SC_MANAGER_CONNECT);
        if (scManager == IntPtr.Zero)
        {
            MessageBox.Show($"打开服务管理器失败：{Marshal.GetLastWin32Error()}");
            return;
        }

        try
        {
            IntPtr spoolerService = OpenService(scManager, "Spooler", SERVICE_CHANGE_CONFIG);
            if (spoolerService == IntPtr.Zero)
            {
                MessageBox.Show($"打开Print Spooler服务失败：{Marshal.GetLastWin32Error()}");
                return;
            }

            try
            {
                // 获取当前服务的安全描述符
                uint neededSize = 0;
                QueryServiceObjectSecurity(spoolerService, DACL_SECURITY_INFORMATION, IntPtr.Zero, 0, out neededSize);
                IntPtr secDescriptor = Marshal.AllocHGlobal((int)neededSize);
                if (!QueryServiceObjectSecurity(spoolerService, DACL_SECURITY_INFORMATION, secDescriptor, neededSize, out neededSize))
                {
                    MessageBox.Show($"查询服务安全描述符失败：{Marshal.GetLastWin32Error()}");
                    Marshal.FreeHGlobal(secDescriptor);
                    return;
                }

                try
                {
                    // 将安全描述符转换为Managed对象
                    RawSecurityDescriptor rawSecDesc = new RawSecurityDescriptor(secDescriptor, 0);
                    RawAcl rawAcl = rawSecDesc.DiscretionaryAcl;

                    // 创建用户的身份标识
                    NTAccount ntAccount = new NTAccount(userName);
                    SecurityIdentifier sid = (SecurityIdentifier)ntAccount.Translate(typeof(SecurityIdentifier));

                    // 创建新的访问规则：允许启停和查询状态权限
                    int accessMask = SERVICE_START | SERVICE_STOP | SERVICE_QUERY_STATUS;
                    CommonAce newAce = new CommonAce(AceFlags.None, AceQualifier.AccessAllowed, accessMask, sid, false, null);

                    // 添加到ACL
                    rawAcl.InsertAce(rawAcl.Count, newAce);
                    rawSecDesc.DiscretionaryAcl = rawAcl;

                    // 将修改后的安全描述符转换回非托管内存
                    byte[] secDescBuffer = new byte[rawSecDesc.BinaryLength];
                    rawSecDesc.GetBinaryForm(secDescBuffer, 0);
                    Marshal.Copy(secDescBuffer, 0, secDescriptor, secDescBuffer.Length);

                    // 应用修改到服务
                    if (!SetServiceObjectSecurity(spoolerService, DACL_SECURITY_INFORMATION, secDescriptor))
                    {
                        MessageBox.Show($"设置服务权限失败：{Marshal.GetLastWin32Error()}");
                    }
                    else
                    {
                        MessageBox.Show($"已成功给用户 {userName} 添加Print Spooler服务启停权限");
                    }
                }
                finally
                {
                    Marshal.FreeHGlobal(secDescriptor);
                }
            }
            finally
            {
                CloseServiceHandle(spoolerService);
            }
        }
        finally
        {
            CloseServiceHandle(scManager);
        }
    }
}

关键说明 #

• 此代码直接操作服务的ACL，比调用外部进程（如sc命令）更可靠，能精准控制权限范围。
• 必须确保程序以管理员身份运行，否则所有服务操作都会失败。
• 用户名需输入正确格式：本地用户用.\用户名，域用户用域名\用户名。

内容的提问来源于stack exchange，提问作者Yomtov