CreateService Failing on windows 7

Question

I am trying to install a service using CreateService API in Windows 7 64 bit.When CreateService API is called, it fails with Error code 1314 which is "A required privilege is not held by the client. ".

I am running Visual studio in Administrator mode. Any idea why it still failing when service is getting created by a process running in admin mode.

Also I am trying to create service with ACCESS_SYSTEM_SECURITY as one of desired access flag.CreateService is failing only when ACCESS_SYSTEM_SECURITY is passed otherwise its working fine.

Here is code

    LUID luidSecurityPriv;
    HANDLE hTokenProcCur;
  if (OpenProcessToken(GetCurrentProcess(), TOKEN_ALL_ACCESS | TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hTokenProcCur))
        {

    if (LookupPrivilegeValue(NULL, L"SeSecurityPrivilege", &luidSecurityPriv))
    {
        TOKEN_PRIVILEGES tp;
        DWORD cbSinglePriv= sizeof(TOKEN_PRIVILEGES);
        tp.PrivilegeCount= 1;
        tp.Privileges[0].Luid= luidSecurityPriv;
        tp.Privileges[0].Attributes= SE_PRIVILEGE_ENABLED;
        if (AdjustTokenPrivileges(hTokenProcCur,
                                  FALSE,
                                  &tp,
                                  cbSinglePriv,
                                  NULL,
                                  NULL))
        {
            // actually register the NanoService with the OS here
            SC_HANDLE schService = CreateService(schSCManager,                  
                                                 _T(SERVICE_NAME),      
                                                 (LPCTSTR)strServiceName,               
                                                 SERVICE_QUERY_STATUS | SERVICE_CHANGE_CONFIG | SERVICE_START | READ_CONTROL | WRITE_DAC | ACCESS_SYSTEM_SECURITY,      // desired access
                                                 SERVICE_WIN32_OWN_PROCESS,     // service type
                                                 SERVICE_AUTO_START,                // start type
                                                 SERVICE_ERROR_NORMAL,          // error control type
                                                 strServicePath,                            // service's binary
                                                 NULL,                          // no load ordering group
                                                 NULL,                          // no tag identifier
                                                 NULL,                          // dependencies
                                                 NULL,                          // LocalSystem account
                                                 NULL);                         // no password

            if (schService)
            {
                MessageBox(NULL,"CreateService Succeeded",L"",MB_OK);
            }
            else
                MessageBox(NULL,"CreateService failed",L"",MB_OK);
        }
    }   
    }

Answer 1

The description for ACCESS_SYSTEM_SECURITY states the requirements for this access right:

The proper way to obtain this access is to enable the SE_SECURITY_NAME privilege in the caller's current access token, open the handle for ACCESS_SYSTEM_SECURITY access, and then disable the privilege.