Differences

This shows you the differences between two versions of the page.

--- additional_resources:jc360_and_jcappservice [2025/12/04 12:55] – support
+++ additional_resources:jc360_and_jcappservice [2025/12/04 13:19] (current) – removed support
@@ Line 1: / Line 1: @@
-====== Preventing Users From Stopping JC360 and JcAppChk Services on Windows ======
-^This guide explains how clients can configure Windows to prevent user, including local administrators from stopping the JC360 service or the JC360:JcAppChkService. Instructions for undoing the modifications are included at the end.^
-===== Overview =====
-The JC360 system relies on two primary components:
-  * **JC360 Service** – the core activity tracking and monitoring component.
-  * **JobCTRL:JcAppChkService** – a protection service designed to prevent users from terminating JC360 processes (e.g., from Task Manager).
-To ensure the protection layer functions correctly, both components must be installed and specific service permissions (ACLs) must be adjusted.
-===== 1. Install the JC360 Protection Service =====
-The JcAppChk service prevents end-users from stopping the JC360 process through Task Manager or service control interfaces.
-  - Download and install the protection service:
-    * [[https://jobctrl.com/install/JcAppService.msi|JcAppService.msi]]
-Once installed, the service actively monitors JC360 and prevents unauthorized termination attempts.
-===== 2. Prevent Users and Administrators from Stopping the Protection Service =====
-By default, Windows allows members of the **Administrators** group to stop services.
-To fully protect JC360, you must modify the service’s ACL so that only the **SYSTEM** account retains start/stop privileges.
-==== 2.1 Save the Original Service ACL (Recommended) ====
-Run the following command and save the output somewhere secure:
-**sc.exe sdshow "JobCTRL:JcAppChkService**
-This allows administrators to safely revert any changes later.
-==== 2.2 Apply the Restricted ACL (Block Stop/Start Actions) ====
-Use this command to remove start/stop permissions from all users and admins:
-**sc.exe sdset "JobCTRL:JcAppChkService" "D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCLCSWLOCRRC;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"**
-{{:additional_resources:jcappservice_nottostop.png?800|}}
-Explanation:
-  * **SYSTEM** retains full control.
-  * **Administrators** can still read the service configuration but cannot stop/start it.
-  * **Users** and **interactive users** cannot modify or stop the service.
-  * JC360 and JcAppChk remain protected from termination attempts.
-No restart is required; changes take effect immediately.
-===== 3. Undoing or Reverting the ACL Modifications =====
-If a client later needs to uninstall, modify, or update JC360, it may be necessary to restore the service’s original ACL rights.
-There are two methods:
-==== 3.1 Restore ACL Using a SYSTEM-Level Command Prompt (via PsExec) ====
-Download PsTools:
-  * [[https://download.sysinternals.com/files/PSTools.zip|PSTools.zip]]
-Start a SYSTEM-authorized command prompt:
-psexec -i cmd
-Then restore the ACL (example — replace with the backup you saved):
-**sc.exe sdset "JobCTRL:JcAppChkService" "D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"**
-{{:additional_resources:jcappservice_lettostop.png?800|}}
-==== 3.2 Restore ACL in One Step (Running sc.exe as SYSTEM) ====
-psexec -accepteula -s sc.exe sdset "JobCTRL:JcAppChkService" "<original ACL here>"
-Replace `<original ACL here>` with the ACL saved earlier using **sdshow**.
-===== 4. Notes and Recommendations =====
-  * Always save the original ACL before applying restrictions.
-  * For JC360 updates or maintenance, restore the ACL first, then reapply after the update.
-  * Blocking service stop/start actions enhances security and guarantees uninterrupted monitoring.
-  * All changes are completely reversible.
-===== Support =====
-For assistance or additional guidance, contact our support team:
-[[support@jobctrl.com|support@jobctrl.com]]