Minimum permissions to allow COM Object to be Instantiated when running as LocalService
- by Paul Farry
I'm writing a .NET Service that creates a COM object.
If I run the Service as the Logged on user (everything is fine).
If I run the Service as LocalSystem, everything is fine.
If I run the Service as LocalService, then I get an AccessDeniedException when trying to instantiate the COM Object.
I've come up with the following block to grant the necessary permissions and it appears to work correctly, but I wanted to make sure I wasn't missing something regarding the COM rules.
Private Sub SetAccessToRockeyRegistry()
Using reg As RegistryKey = Microsoft.Win32.Registry.ClassesRoot.OpenSubKey("CLSID\{EE0680D3-AAC3-446B-AFD7-F9DE2D3E28FB}", True)
Dim sec As RegistrySecurity
sec = reg.GetAccessControl
Dim ar As RegistryAccessRule
Dim sid As SecurityIdentifier
sid = New SecurityIdentifier(WellKnownSidType.LocalServiceSid, Nothing)
ar = New RegistryAccessRule(sid, RegistryRights.ReadKey Or RegistryRights.EnumerateSubKeys Or RegistryRights.QueryValues, AccessControlType.Allow)
sec.AddAccessRule(ar)
ar = New RegistryAccessRule(sid, RegistryRights.ReadKey Or RegistryRights.EnumerateSubKeys Or RegistryRights.QueryValues, _
InheritanceFlags.ObjectInherit Or InheritanceFlags.ContainerInherit, PropagationFlags.InheritOnly Or PropagationFlags.NoPropagateInherit, AccessControlType.Allow)
sec.AddAccessRule(ar)
reg.SetAccessControl(sec)
End Using
End Sub
