sc.exe qsidtype queries the configured Service SID type for a Windows service. It is a read-only Service Control Manager command: it tells you whether a service is configured with no per-service SID, an unrestricted Service SID, or a restricted Service SID.

This lesson follows Windows Command #47 – sc privs, Windows Command #46 – sc qprivs, and Windows Command #38 – sc qc. Together, these commands help inspect service identity, privileges, and configuration before you make security-sensitive changes.

Attack Detect Defend explains why Windows services are security-sensitive objects and shows how the Service Control Manager fits into service execution, persistence, detection, and defense.

What You’ll Learn

• Explain what a Windows Service SID is.
• Run sc.exe qsidtype SERVICE_NAME.
• Interpret NONE, UNRESTRICTED, and RESTRICTED.
• Distinguish the SID type from the actual SID value.
• Understand why Service SIDs improve resource isolation.
• Recognize the shared-process restriction rule.
• Use SID-type checks during Windows Firewall and service-hardening troubleshooting.

What Is a Service SID?

A Windows Service SID is a security identity associated with a specific service. Microsoft introduced per-service SIDs as part of Windows Service Hardening so permissions can be granted to one service rather than broadly to every service running under the same built-in account.

The friendly account form is NT SERVICE\ServiceName. The underlying SID uses the S-1-5-80-... namespace. This lets administrators place a service-specific identity in an access control list for a file, registry key, named object, database permission, or other securable resource.

Microsoft’s SERVICE_SID_INFO documentation defines three Service SID types: NONE, UNRESTRICTED, and RESTRICTED.

Basic Syntax

Command: sc.exe qsidtype SERVICE_NAME

sc.exe qsidtype w32time

A successful query returns the service name and a SERVICE_SID_TYPE value. Because this is a query operation, it does not change the service configuration.

In PowerShell, use sc.exe explicitly. On some PowerShell versions and profiles, sc can resolve to another command or alias rather than the Service Control executable.

SERVICE_SID_TYPE: NONE

NONE means the service is not configured to add a per-service SID to its process token through this mechanism. Microsoft documents this as SERVICE_SID_TYPE_NONE.

Do not interpret NONE as “the service has no identity.” The service still runs under a service account or built-in account and still has a process token. The result only tells you that the per-service SID feature is not enabled for that service.

An r/sysadmin discussion examines exactly what enabling an unrestricted SID type changes for the Windows NPS service and why service-specific identity matters to Windows Firewall rules.

SERVICE_SID_TYPE: UNRESTRICTED

UNRESTRICTED means the Service Control Manager is configured to add the service’s per-service SID to the service process token when the applicable service process is created. Microsoft documents the service SID as enabled by default in the token and capable of being used as an owner SID.

This enables permissions such as NT SERVICE\MSSQLSERVER or NT SERVICE\HealthService to be granted directly to the service rather than granting equivalent access to a broad account such as LocalSystem.

Microsoft’s SQL Server guidance uses this pattern to grant rights directly to service identities. The same security concept applies outside SQL Server: the Service SID can be placed in ACLs so only the intended service receives access.

SERVICE_SID_TYPE: RESTRICTED

RESTRICTED includes the per-service SID and also places Service SID information in the restricted portion of the token. Microsoft documents additional restricted SIDs including the World SID, the service logon SID, and the write-restricted SID S-1-5-33.

The practical goal is tighter write isolation. A service configured this way can be prevented from writing to resources unless the relevant restricted identities are allowed. This is a stronger configuration than merely adding a Service SID.

Shared-process warning: Microsoft states that if several services are hosted in the same process and one service uses RESTRICTED, all services hosted in that process must use RESTRICTED. This is one reason administrators should inspect the service hosting model before changing SID types.

ManageEngine reviews Windows service-account security and least-privilege practices, providing broader context for why per-service identities and narrowly scoped permissions matter.

qsidtype Does Not Show the Actual SID

sc.exe qsidtype tells you the type of Service SID configuration. It does not print the actual S-1-5-80-... identifier.

To display the actual SID generated for a service, use sc.exe showsid SERVICE_NAME. That will be covered separately so the query for SID type and the query for the SID value remain distinct troubleshooting steps.

Why Windows Firewall May Care About SID Type

Current Microsoft Windows Firewall guidance says a firewall rule that is scoped to a specific service requires the service to have a SID type of UNRESTRICTED or RESTRICTED. If sc qsidtype SERVICE_NAME returns NONE, the service cannot be targeted by that service-specific firewall-rule option.

This makes qsidtype a useful diagnostic command when a service-specific firewall rule appears correct but does not behave as expected.

A pfSense community post documents a real Windows Server RADIUS troubleshooting case involving sc sidtype IAS unrestricted and service-aware Windows Firewall behavior.

Query a Remote Computer

SC supports a remote server name in UNC form before the command:

sc.exe \\SERVER01 qsidtype w32time

Remote queries require connectivity to the remote Service Control Manager and sufficient permissions. An access-denied response is an authorization problem, not evidence that the target service has no Service SID.

A Safe Inspection Workflow

1. Identify the service’s short name.
2. Run sc.exe qc SERVICE_NAME to inspect its configuration and service type.
3. Run sc.exe qsidtype SERVICE_NAME.
4. Record whether the result is NONE, UNRESTRICTED, or RESTRICTED.
5. If you need the actual Service SID, run sc.exe showsid SERVICE_NAME.
6. If you are troubleshooting a firewall rule, confirm that the SID type is not NONE.
7. If you are reviewing resource permissions, look for an ACE using NT SERVICE\ServiceName or the corresponding Service SID.
8. Do not change the SID type until you understand the service’s resource and hosting requirements.

Common Mistakes

• Confusing SID type with the SID itself: qsidtype reports the configuration class; showsid reports the actual SID value.
• Assuming NONE means no account: the service still has a normal process token and service account context.
• Assuming UNRESTRICTED means “no security”: it means the per-service SID is added without the additional restricted-token behavior.
• Changing to RESTRICTED casually: tighter write restrictions can break services whose resources are not ACLed correctly.
• Ignoring shared-process hosting: restricted SID behavior has special requirements when services share a process.
• Using a display name instead of the service name: use the service’s short name with SC commands.

Hands-On Exercise

1. Open an elevated Command Prompt or PowerShell window on a disposable Windows VM.
2. Run sc.exe query and choose two noncritical services to inspect.
3. Run sc.exe qc SERVICE_NAME for each service.
4. Run sc.exe qsidtype SERVICE_NAME for each service.
5. Record the returned SID type.
6. Run sc.exe showsid SERVICE_NAME and compare the actual SID with the SID-type result.
7. Open the security properties of a disposable folder and check whether NT SERVICE\ServiceName can be resolved for a service with an enabled Service SID.
8. Do not change SID types in this exercise. The goal is inspection and interpretation.

Knowledge Check

1. What does sc.exe qsidtype query?
2. Does qsidtype change the service?
3. What are the three SID-type values?
4. What does NONE mean?
5. What additional behavior distinguishes RESTRICTED from UNRESTRICTED?
6. Which command prints the actual Service SID?
7. Why can Service SIDs be safer than granting access broadly to LocalSystem?
8. Why does shared-process hosting matter for restricted Service SIDs?
9. What SID types can be used for service-specific Windows Firewall rules?

Answers

1. The configured Service SID type for a service.
2. No. It is a query operation.
3. NONE, UNRESTRICTED, and RESTRICTED.
4. No per-service SID is configured to be added through the Service SID mechanism.
5. The Service SID also participates in the restricted token, with additional restricted identities used to limit writes.
6. sc.exe showsid SERVICE_NAME.
7. Permissions can be granted to one specific service instead of every process sharing a broad built-in service account.
8. If one service in a shared process is configured as restricted, Microsoft requires all services in that process to be restricted.
9. UNRESTRICTED or RESTRICTED.

Key Takeaway

sc.exe qsidtype is the inspection command for per-service SID configuration. Use it to determine whether a service is operating with no Service SID configuration, an unrestricted per-service identity, or a restricted service identity before you troubleshoot ACLs, service-aware firewall rules, or Windows Service Hardening.

Primary references: Microsoft Learn — Configuring a Service Using SC, Microsoft Learn — SERVICE_SID_INFO, and Microsoft Learn — Windows Firewall configuration.

Next: Windows Command #49 will cover sc sidtype, the write-side command used to configure the Service SID type.

BitcoinVersus.Tech provides technical education and analysis for informational purposes only. Test service-security changes in a disposable environment before applying them to production systems.