Preventing Users From Stopping JC360 and JcAppChk Services on Windows

The JC360 system relies on two primary components:

• JC360 Service – the core activity tracking and monitoring component.
• JobCTRL:JcAppChkService – a protection service designed to prevent users from terminating JC360 processes (e.g., from Task Manager).

To ensure the protection layer functions correctly, both components must be installed and specific service permissions (ACLs) must be adjusted.

The JcAppChk service prevents end-users from stopping the JC360 process through Task Manager or service control interfaces.

1. Download and install the protection service:
   • JcAppService.msi

Once installed, the service actively monitors JC360 and prevents unauthorized termination attempts.

By default, Windows allows members of the Administrators group to stop services. To fully protect JC360, you must modify the service’s ACL so that only the SYSTEM account retains start/stop privileges.

Run the following command and save the output somewhere secure:
sc.exe sdshow “JobCTRL:JcAppChkService

This allows administrators to safely revert any changes later.

Use this command to remove start/stop permissions from all users and admins:
sc.exe sdset “JobCTRL:JcAppChkService” “D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCLCSWLOCRRC;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)“

Explanation:

• SYSTEM retains full control.
• Administrators can still read the service configuration but cannot stop/start it.
• Users and interactive users cannot modify or stop the service.
• JC360 and JcAppChk remain protected from termination attempts.

No restart is required; changes take effect immediately.

If a client later needs to uninstall, modify, or update JC360, it may be necessary to restore the service’s original ACL rights.

There are two methods:

Download PsTools:

• PSTools.zip

Start a SYSTEM-authorized command prompt:

psexec -i cmd

Then restore the ACL (example — replace with the backup you saved):
psexec -accepteula -s sc.exe sdset “JobCTRL:JcAppChkService” “D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)“

psexec -accepteula -s sc.exe sdset “JobCTRL:JcAppChkService” ”<original ACL here>”

Replace `<original ACL here>` with the ACL saved earlier using sdshow.

• Always save the original ACL before applying restrictions.
• For JC360 updates or maintenance, restore the ACL first, then reapply after the update.
• Blocking service stop/start actions enhances security and guarantees uninterrupted monitoring.
• All changes are completely reversible.

For assistance or additional guidance, contact our support team: support@jobctrl.com