Windows Services Security: A Complete Guide

Securing Windows services is a crucial aspect of cybersecurity. This guide explores advanced techniques for protecting and managing services.

1. Service Management

Basic Configuration

# Disable non-essential services
sc config RemoteRegistry start= disabled
sc config Telnet start= disabled
sc config TFTP start= disabled

# Configure permissions
sc sdset RemoteRegistry D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)

Critical Services

# Identify critical services
$criticalServices = @(
    "RemoteRegistry",
    "Telnet",
    "TFTP",
    "SNMP",
    "IISADMIN",
    "W3SVC"
)

# Secure disabling
foreach ($service in $criticalServices) {
    if (Get-Service $service -ErrorAction SilentlyContinue) {
        Stop-Service $service
        Set-Service $service -StartupType Disabled
    }
}

2. Securing Permissions

ACL Configuration

# Configure service permissions
$servicePath = "C:\Windows\System32\services.exe"
$acl = Get-Acl $servicePath
$rule = New-Object System.Security.AccessControl.FileSystemAccessRule("Administrators","FullControl","Allow")
$acl.SetAccessRule($rule)
Set-Acl $servicePath $acl

# Protect service folders
$serviceFolders = @(
    "C:\Windows\System32\drivers",
    "C:\Windows\System32\config",
    "C:\Windows\ServiceProfiles"
)

foreach ($folder in $serviceFolders) {
    $acl = Get-Acl $folder
    $acl.SetAccessRuleProtection($true, $false)
    Set-Acl $folder $acl
}

Rights Management

# Configure service rights
$serviceRights = @{
    "SeServiceLogonRight" = "SERVICE_LOGON"
    "SeAssignPrimaryTokenPrivilege" = "ASSIGN_PRIMARY_TOKEN"
    "SeIncreaseQuotaPrivilege" = "INCREASE_QUOTA"
}

# Apply rights
foreach ($right in $serviceRights.GetEnumerator()) {
    $policy = New-Object System.Security.Principal.NTAccount("NT AUTHORITY\SYSTEM")
    $privilege = [System.Security.Principal.Privilege]::$($right.Value)
    $policy.AddPrivilege($privilege)
}

3. Service Monitoring

Active Monitoring

# Service monitoring script
function Monitor-Services {
    $services = Get-Service | Where-Object {$_.Status -eq "Running"}
    foreach ($service in $services) {
        $process = Get-Process -Name $service.Name -ErrorAction SilentlyContinue
        if ($process) {
            Write-Host "Service: $($service.Name) - PID: $($process.Id) - CPU: $($process.CPU) - Memory: $($process.WorkingSet64/1MB) MB"
        }
    }
}

Anomaly Detection

# Anomaly detection script
function Detect-ServiceAnomalies {
    $baseline = @{
        "svchost.exe" = @(100, 200)  # Normal PID range
        "services.exe" = @(500, 600)
    }
    
    $current = Get-Process | Where-Object {$_.ProcessName -in $baseline.Keys}
    foreach ($proc in $current) {
        if ($proc.Id -lt $baseline[$proc.ProcessName][0] -or $proc.Id -gt $baseline[$proc.ProcessName][1]) {
            Write-Host "Anomalie détectée: $($proc.ProcessName) avec PID $($proc.Id)"
        }
    }
}

4. Protection Against Attacks

Detecting Malicious Services

# Malicious service detection script
function Detect-MaliciousServices {
    $suspiciousPatterns = @(
        "cryptominer",
        "miner",
        "botnet",
        "backdoor"
    )
    
    $services = Get-Service
    foreach ($service in $services) {
        foreach ($pattern in $suspiciousPatterns) {
            if ($service.DisplayName -match $pattern -or $service.Name -match $pattern) {
                Write-Host "Service suspect détecté: $($service.Name)"
            }
        }
    }
}

Injection Protection

# Injection protection configuration
$protectionSettings = @{
    "EnableLUA" = 1
    "EnableVirtualization" = 1
    "EnableInstallerDetection" = 1
}

foreach ($setting in $protectionSettings.GetEnumerator()) {
    Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name $setting.Key -Value $setting.Value
}

5. Auditing and Logging

Audit Configuration

# Enable service auditing
auditpol /set /category:"System" /success:enable /failure:enable
auditpol /set /category:"Security" /success:enable /failure:enable

# Configure logs
wevtutil sl System /maxsize:4294967296 /retention:true
wevtutil sl Security /maxsize:4294967296 /retention:true

Log Analysis

# Service log analysis script
function Analyze-ServiceLogs {
    $events = Get-EventLog -LogName System -Source "Service Control Manager" -After (Get-Date).AddHours(-24)
    foreach ($event in $events) {
        if ($event.EntryType -eq "Error" -or $event.EntryType -eq "Warning") {
            Write-Host "Problème détecté: $($event.TimeGenerated) - $($event.Message)"
        }
    }
}

6. Maintenance and Updates

Update Management

# Service update script
function Update-Services {
    # Check for Windows updates
    $updateSession = New-Object -ComObject Microsoft.Update.Session
    $searcher = $updateSession.CreateUpdateSearcher()
    $searchResult = $searcher.Search("IsInstalled=0")
    
    if ($searchResult.Updates.Count -gt 0) {
        $installer = $updateSession.CreateUpdateInstaller()
        foreach ($update in $searchResult.Updates) {
            $installer.Updates.Add($update)
        }
        $installer.Install()
    }
}

Service Cleanup

# Service cleanup script
function Cleanup-Services {
    # Remove orphaned services
    $orphanedServices = Get-Service | Where-Object {
        $servicePath = (Get-WmiObject Win32_Service -Filter "Name='$($_.Name)'").PathName
        -not (Test-Path $servicePath)
    }
    
    foreach ($service in $orphanedServices) {
        Stop-Service $service.Name
        sc delete $service.Name
    }
}

7. Security Scripts

Security Verification

# Service security verification script
function Test-ServiceSecurity {
    $issues = @()
    
    # Check critical services
    $criticalServices = @("RemoteRegistry", "Telnet", "TFTP")
    foreach ($service in $criticalServices) {
        if ((Get-Service $service -ErrorAction SilentlyContinue).Status -eq "Running") {
            $issues += "Service critique $service est en cours d'exécution"
        }
    }
    
    # Check permissions
    $servicePath = "C:\Windows\System32\services.exe"
    $acl = Get-Acl $servicePath
    if (-not ($acl.Access | Where-Object {$_.IdentityReference -eq "NT AUTHORITY\SYSTEM"})) {
        $issues += "Permissions incorrectes sur services.exe"
    }
    
    return $issues
}

Automated Maintenance

# Service maintenance script
function Update-ServiceSecurity {
    # Disable non-essential services
    $nonEssentialServices = @(
        "RemoteRegistry",
        "Telnet",
        "TFTP",
        "SNMP"
    )
    
    foreach ($service in $nonEssentialServices) {
        if (Get-Service $service -ErrorAction SilentlyContinue) {
            Stop-Service $service
            Set-Service $service -StartupType Disabled
        }
    }
    
    # Update permissions
    $serviceFolders = @(
        "C:\Windows\System32\drivers",
        "C:\Windows\System32\config"
    )
    
    foreach ($folder in $serviceFolders) {
        $acl = Get-Acl $folder
        $acl.SetAccessRuleProtection($true, $false)
        Set-Acl $folder $acl
    }
}

Conclusion

Securing Windows services requires:

• Strict service management
• Proper permission configuration
• Constant monitoring
• Regular updates
• Accurate documentation

Key takeaways:

• Disable non-essential services
• Maintain least-privilege permissions
• Watch for anomalies
• Perform regular audits
• Follow security best practices