I am pretty impressed with the changes and new features for good old NT Services in Vista/Server 2008.
My favourite feature is, that every service can now have a distinct SID that can be used to ACL kernel objects. Imagine you have to deploy a bunch of services that have to be isolated from each other. Pre-Vista you would have to create an account for each service. Now you can simply use the new NT ServiceServiceName SID to control authorization. Very neat.
Even better the SIDs for services are deterministic across machines (S-1-5-80-SHA1(Servicename) to be exact), and you can also pre-calculate the SID even when the service doesn’t exist yet:
sc showsid FooService
This makes it very easy in server farms to copy data *and* ACLs (e.g. using robocopy) between nodes…
Additionally you can write-restrict the service tokens – that means that the service won’t have write access to any kernel object unless the service SID is explicitly part of the ACL.
Other nice features are that services no longer share the same desktop with interactive users and that you can bundle network access rules with services. These rules are independent from the Windows firewall and would even work if the firewall is disabled.
Nice least privilege work, guys!
Voy has written a series of blog posts about the new features (recommended reading):
leastprivilege.com 