So, my problem goes like this. I want to have locked down folder only accessible to admins and Local Service. This is what I did:
# Reset permissions
Start-Process -FilePath $Icacls -ArgumentList "`"$SecureFolder`" /reset /T" -Wait -NoNewWindow
Start-Process -FilePath $Icacls -ArgumentList "`"$SecureFolder`" /inheritance:r" -Wait -NoNewWindow
# Apply strict access control
# Caution: Even though the we only have services registered for Local Service/Local System, we still need Admin due to the way PsExec behaves
Start-Process -FilePath $Icacls -ArgumentList "`"$SecureFolder`" /grant:r Administrators:(OI)(CI)(F)" -Wait -NoNewWindow
Start-Process -FilePath $Icacls -ArgumentList "`"$SecureFolder`" /grant:r `"NT AUTHORITYLOCAL SERVICE`":(OI)(CI)(F)" -Wait -NoNewWindow
I’m running my processes with WinSW. Everything is fine as long as the processes are registered as SYSTEM but as soon as I register them as Local Service, they break because the files they create have the correct owner (Local Service) but an empty Access column. If I then restart this service, they crash because they cannot access their own files (log files in this case). The same thing happens when I start the executable via task scheduler, using Local Service.
What am I missing? Or is Local Service simply not supposed to write to restricted areas, even with explicit permissions?
