windows 远程 OpenSCManager 因访问被拒绝而失败
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/8434766/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Remote OpenSCManager fails with access denied
提问by villintehaspam
I am attempting to control a service on a remote machine using the following code:
我正在尝试使用以下代码控制远程机器上的服务：
// Error checking omitted for brevity
HANDLE hToken = NULL;
// user = username with no domain specification
// domain = targetmachine when targetting computer outside of domain
LogonUser(user, domain, password,
LOGON32_LOGON_NEW_CREDENTIALS, LOGON32_PROVIDER_WINNT50, &hToken);
ImpersonateLoggedOnUser(hToken);
SC_HANDLE hSc = OpenSCManager(targetmachine,
SERVICES_ACTIVE_DATABASE, SC_MANAGER_ALL_ACCESS);
This works fine when run from a computer within our local domain and targetting a machine on the same domain, both when using the credentials from the currently logged on user as well as when using other credentials.
当从我们本地域中的计算机运行并以同一域中的计算机为目标时，无论是使用当前登录用户的凭据还是使用其他凭据时，这都可以正常工作。
However, when I attempt to target a machine that is not on any domain, the OpenSCManagercall fails with access denied if I specify anything other than SC_MANAGER_CONNECTas the desired access. Targetting a domain computer from a computer that is outside the domain works (using user/domain/password combination for a domain user that is a local administrator on the target machine). Targetting a computer outside the domain from a computer outside the domain does not work.
但是，当我尝试以不在任何域中的计算机为目标时，OpenSCManager如果我指定的不是SC_MANAGER_CONNECT所需访问的任何内容，调用将失败并拒绝访问。从域外的计算机定位域计算机是可行的（对作为目标计算机上的本地管理员的域用户使用用户/域/密码组合）。从域外的计算机定位域外的计算机不起作用。
The user/password is for a member of the administrator group on the target computer, so there should not be a problem with the account rights.
用户/密码是针对目标计算机管理员组成员的，因此帐户权限应该没有问题。
I've checked the scmanager security descriptor using sc -sdshow scmanagerand it is identical for the domain computer and the non-domain computer. Both are running Windows 7 64-bit.
我已经检查了使用的 scmanager 安全描述符sc -sdshow scmanager，它对于域计算机和非域计算机是相同的。两者都运行 Windows 7 64 位。
I've also tested to use psexec, which has the same symptoms, i.e. works fine between domain computers but not when targetting non-domain computer.
我还测试过使用psexec，它具有相同的症状，即在域计算机之间工作正常，但在针对非域计算机时则不然。
I have also tested to disable RPC over TCP on the target machine and rebooting it, as this is described as a possible cause for access denied errorsbut this does not appear to help. I've also tested to disable the Windows Firewall on the targetmachine, but no change.
我还测试了在目标机器上禁用 RPC over TCP 并重新启动它，因为这被描述为访问被拒绝错误的可能原因，但这似乎没有帮助。我还测试了禁用目标机器上的 Windows 防火墙，但没有任何变化。
Is there some setting that needs to be enabled in order for remote configuration of services to work?
是否需要启用某些设置才能使服务的远程配置工作？
回答by villintehaspam
It appears that this was caused by new security features from Windows Vista and above. By default, Windows will not grant remotely connecting users full administrator rights unless it is being done within a domain. So in order for this to work, User Account Control Remote Restrictionsneed to be turned off, but of course this will also lower the security of your computer.
这似乎是由 Windows Vista 及更高版本的新安全功能引起的。默认情况下，Windows 不会授予远程连接用户完全管理员权限，除非它是在域内完成的。因此，为了使其正常工作，需要关闭用户帐户控制远程限制，但这当然也会降低计算机的安全性。
Thanks to Hans Passant for recommending to check for similar issues posted on serverfault.com.
感谢 Hans Passant 建议检查发布在 serverfault.com 上的类似问题。
