Automatic Updates服务无法启动

现在很多服务器安装了WSUS但是总会遇到客户端Automatic Updates服务无法启动，启动时候出现0x80004015错误：
Automatic Updates 服务因下列错误而停止:
此类别是作为跟调用程序不同的安全 id 运行的

使用下列命令搞定，就是修改了服务的安全描述。
sc sdset wuauserv D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)

 

后面那一串奇怪的字符就是安全描述，这个是使用的SDDL格式，查了些资料，弄明白了一点。（看的是ADAM的资料，嘿嘿）下面就开始copy他的文章了。

代码:
第三段：
这就是全文的重点－－SDDL

首先我们看看这 D:AR(D;OICI;FA;;;BG) 中的第一个字段，这里填充的是D，
我们可以选择的有：
(O:) owner, (G:)primary group, (D:)DACL , (S:)SACL .也就是说我们可以通过inf文件设置对象的Owner，Primary Group，DACL和SACL，一般最常见的也就是上面提到的D，设置文件的访问控制列表。

再看看第二个字段，上面填写的是AR，这个字段只有当你设置ACL时才会出现
设置DACL时，我们可以选择的有：
"P"--SE_DACL_PROTECTED flag, Protects the DACL of the security descriptor from being modified by inheritable ACEs.
"AR"--SE_DACL_AUTO_INHERIT_REQ flag, Requests that the provider for the object protected by the security descriptor automatically propagate the DACL to existing child objects. If the provider supports automatic inheritance, it propagates the DACL to any existing child objects, and sets the SE_DACL_AUTO_INHERITED bit in the security descriptors of the object and its child objects.
"AI"--SE_DACL_AUTO_INHERITED flag, Indicates a security descriptor in which the DACL is set up to support automatic propagation of inheritable ACEs to existing child objects. This bit is set only if the automatic inheritance algorithm has been performed for the object and its existing child objects.
This bit is not set in security descriptors for Windows NT versions 4.0 and earlier, which did not support automatic propagation of inheritable ACEs.

设置SACL时，我们可以选择的有：
"P"--SE_SACL_PROTECTED flag, Protects the SACL of the security descriptor from being modified by inheritable ACEs.
"AR"--SE_DACL_AUTO_INHERIT_REQ flag, Requests that the provider for the object protected by the security descriptor automatically propagate the SACL to existing child objects. If the provider supports automatic inheritance, it propagates the SACL to any existing child objects, and sets the SE_SACL_AUTO_INHERITED bit in the security descriptors of the object and its child objects.
"AI"--SE_DACL_AUTO_INHERITED flag, Indicates a security descriptor in which the SACL is set up to support automatic propagation of inheritable ACEs to existing child objects. This bit is set only if the automatic inheritance algorithm has been performed for the object and its existing child objects.
This bit is not set in security descriptors for Microsoft Windows NT versions 4.0 and earlier, which did not support automatic propagation of inheritable ACEs.

注：原谅我不翻译上面的文字，因为这些东西真的无法用中文表示，很多东西没有一个权威的翻译，我也不想被人家笑话。

OK，我们最后看看最复杂的第三段 D;OICI;FA;;;BG ，被5个分号分成6个小节
第一节：ACE类型，我们这里使用的是 D，可以选择的有
"A"  ACCESS_ALLOWED
"D"  ACCESS_DENIED
"OA" OBJECT ACCESS ALLOWED
"OD" OBJECT ACCESS DENIED
"AU" AUDIT
"AL" ALARM
"OU" OBJECT AUDIT
"OL" OBJECT ALARM

第二节：ACE标志，我们这里的值是OICI，可以选择的有
"CI" CONTAINER INHERIT
"OI" OBJECT INHERIT
"NP" NO PROPAGATE
"IO" INHERIT ONLY
"ID" INHERITED
"SA" AUDIT SUCCESS
"FA" AUDIT FAILURE

第三节：权限类型，我们这里的值是FA，可以选择的有
对于目录而言：
"RP" READ
"WP" WRITE
"CC" CREATE CHILD
"DC" DELETE CHILD
"LC" LIST CHILDREN
"SW" SELF WRITE
"LO" LIST OBJECT
"DT" DELETE TREE
"CR" CONTROL ACCESS
对于文件而言：
"FA" ALL
"FR" READ
"FW" WRITE
"FX" EXECUTE
对于注册表权限而言：
"KA" ALL
"KR" READ
"KW" WRITE
"KX" EXECUTE
注：注册表和文件、目录一样，也可以inf文件里设置权限，格式和文件一致，只是把文件名换成键名即可，如machine\software\NSFOCUS\Adam

第四节和第五节都为空，它们分别表示的是Object GUID和inherit object guid，我见过的大多数inf文件这2个字段都为空，我们做inf文件的时候也空就好了 ：）

第六节：这里表示的是用户或组，一般而言我们设置的时候都是系统自带的用户或组，如果你非要为自己建的用户设置这些玩艺，那你就用用户或组的SID表示好了，而系统自带的用户或组，我们的表示方法如下：
"AO" Account operators
"RU" Alias to allow previous Windows 2000
"AN" Anonymous logon
"AU" Authenticated users
"BA" Built-in administrators
"BG" Built-in guests
"BO" Backup operators
"BU" Built-in users
"CA" Certificate server administrators
"CG" Creator group
"CO" Creator owner
"DA" Domain administrators
"DC" Domain computers
"DD" Domain controllers
"DG" Domain guests
"DU" Domain users
"EA" Enterprise administrators
"ED" Enterprise domain controllers
"WD" Everyone
"PA" Group Policy administrators
"IU" Interactively logged-on user
"LA" Local administrator
"LG" Local guest
"LS" Local service account
"SY" Local system
"NU" Network logon user
"NO" Network configuration operators
"NS" Network service account
"PO" Printer operators
"PS" Personal self
"PU" Power users
"RS" RAS servers group
"RD" Terminal server users
"RE" Replicator
"RC" Restricted code
"SA" Schema administrators
"SO" Server operators
"SU" Service logon user
在这个列表里面我们可以很轻松地找到我们所用的BG用户代表的Guests组

如果我们为某个文件或文件夹对象设置多个ACE，
本地Administrators:Full Control
本地Guests:Read

那我们可以写"D:AR(A;OICI;FA;;;LA)(A;OICI;FR;;;BG)"

OK，SDDL的大致介绍就写这么多吧，这些东西光看用处是不大的，还需要自己多加测试，欢迎各位看官不吝指正...