JC360 Wiki

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== Preventing Users From Stopping JC360 and JcAppChk Services on Windows ======

^This guide explains how clients can configure Windows to prevent user, including local administrators from stopping the JC360 service or the JobCTRL:JcAppChkService. Instructions for undoing the modifications are included at the end.^


===== Overview =====
The JC360 system relies on two primary components:

  * **JC360 Service** – the core activity tracking and monitoring component.
  * **JobCTRL:JcAppChkService** – a protection service designed to prevent users from terminating JC360 processes (e.g., from Task Manager).

To ensure the protection layer functions correctly, both components must be installed and specific service permissions (ACLs) must be adjusted.


===== 1. Install the JC360 Protection Service =====
The JcAppChk service prevents end-users from stopping the JC360 process through Task Manager or service control interfaces.

  - Download and install the protection service:
    * [[https://jobctrl.com/install/JcAppService.msi|JcAppService.msi]]

Once installed, the service actively monitors JC360 and prevents unauthorized termination attempts.


===== 2. Prevent Users and Administrators from Stopping the Protection Service =====
By default, Windows allows members of the **Administrators** group to stop services.
To fully protect JC360, you must modify the service’s ACL so that only the **SYSTEM** account retains start/stop privileges.

==== 2.1 Save the Original Service ACL (Recommended) ====
Run the following command and save the output somewhere secure: \\
**sc.exe sdshow "JobCTRL:JcAppChkService**


This allows administrators to safely revert any changes later.


==== 2.2 Apply the Restricted ACL (Block Stop/Start Actions) ====
Use this command to remove start/stop permissions from all users and admins: \\
**sc.exe sdset "JobCTRL:JcAppChkService" "D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCLCSWLOCRRC;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"**


{{:additional_resources:jcappservice_nottostop.png?800|}}

Explanation:

  * **SYSTEM** retains full control.
  * **Administrators** can still read the service configuration but cannot stop/start it.
  * **Users** and **interactive users** cannot modify or stop the service.
  * JC360 and JcAppChk remain protected from termination attempts.

No restart is required; changes take effect immediately.


===== 3. Undoing or Reverting the ACL Modifications =====
If a client later needs to uninstall, modify, or update JC360, it may be necessary to restore the service’s original ACL rights.

There are two methods:


==== 3.1 Restore ACL Using a SYSTEM-Level Command Prompt (via PsExec) ====

Download PsTools:
  * [[https://download.sysinternals.com/files/PSTools.zip|PSTools.zip]]

Start a SYSTEM-authorized command prompt:


psexec -i cmd

Then restore the ACL (example — replace with the backup you saved): \\
**psexec -accepteula -s sc.exe sdset "JobCTRL:JcAppChkService" "D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"**


{{:additional_resources:jcappservice_lettostop.png?800|}}

==== 3.2 Restore ACL in One Step (Running sc.exe as SYSTEM) ====
psexec -accepteula -s sc.exe sdset "JobCTRL:JcAppChkService" "<original ACL here>"

Replace `<original ACL here>` with the ACL saved earlier using **sdshow**.


===== 4. Notes and Recommendations =====
  * Always save the original ACL before applying restrictions.
  * For JC360 updates or maintenance, restore the ACL first, then reapply after the update.
  * Blocking service stop/start actions enhances security and guarantees uninterrupted monitoring.
  * All changes are completely reversible.

--------
===== Help =====
For assistance or additional guidance, contact our support team:  
[[support@jobctrl.com|support@jobctrl.com]]