I have an executable that needs to run as an administrator on a Windows system, and it’s started by a service. For the sake of simplicity and security, I’d prefer just to let the service run as the ‘system’ account, but would like the executable that it spawns to run with administrative privileges.
Is there anything like a chmod +s on Windows that would allow me to do this, such that when I’m installing things and registering the service as an administrator, I can flag the executable to be able to run as an administrator, or to do this would I need to register the service to run as an admin?
On Windows Vista and later, you can embed a manifest file in the executable that requests Windows to start the program with administrator access (see Create and Embed an Application Manifest (UAC)). This may or may not be useful, because the service account still needs administrative privileges even though your service itself need not be running with full administrator access.