Add -SecurityDescriptorSddl parameter to Set-Service (#8626)

test/powershell/Modules/Microsoft.PowerShell.Management/Set-Service.Tests.ps1

@@ -1,5 +1,7 @@
 # Copyright (c) Microsoft Corporation. All rights reserved.
 # Licensed under the MIT License.
+Import-Module (Join-Path -Path $PSScriptRoot '..\Microsoft.PowerShell.Security\certificateCommon.psm1')
+
 Describe "Set/New/Remove-Service cmdlet tests" -Tags "Feature", "RequireAdminOnWindows" {
     BeforeAll {
         $originalDefaultParameterValues = $PSDefaultParameterValues.Clone()
@@ -8,14 +10,16 @@ Describe "Set/New/Remove-Service cmdlet tests" -Tags "Feature", "RequireAdminOnW
         }
         if ($IsWindows) {
             $userName = "testuserservices"
-            $testPass = "Secret123!"
-            net user $userName $testPass /add > $null
-            $password = ConvertTo-SecureString $testPass -AsPlainText -Force
-            $creds = [pscredential]::new(".\$userName", $password)
+            $Password = ([char[]]([char]33..[char]95) + ([char[]]([char]97..[char]126)) + 0..9 | Sort-Object {Get-Random})[0..12] -join ''
+            $testPass = (New-Object -TypeName Net.NetworkCredential("", $Password)).SecurePassword
+            $creds    = [pscredential]::new(".\$userName", $testPass)
+            $SecurityDescriptorSddl = 'D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;SU)'
+            $WrongSecurityDescriptorSddl = 'D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BB)(A;;CCLCSWLOCRRC;;;SU)'
+            net user $userName $creds.GetNetworkCredential().Password /add > $null
 
             $testservicename1 = "testservice1"
             $testservicename2 = "testservice2"
-            $svcbinaryname = "TestService"
+            $svcbinaryname    = "TestService"
             $svccmd = Get-Command $svcbinaryname
             $svccmd | Should -Not -BeNullOrEmpty
             $svcfullpath = $svccmd.Path
@@ -72,12 +76,34 @@ Describe "Set/New/Remove-Service cmdlet tests" -Tags "Feature", "RequireAdminOnW
         @{
             script  = {Set-Service foo -StartupType bar -ErrorAction Stop};
             errorid = "CannotConvertArgumentNoMessage,Microsoft.PowerShell.Commands.SetServiceCommand"
+        },
+        @{
+            script  = {Set-Service -Name $testservicename1 -SecurityDescriptorSddl $WrongSecurityDescriptorSddl };
+            errorid = "System.ArgumentException,Microsoft.PowerShell.Commands.SetServiceCommand"
         }
     ) {
         param($script, $errorid)
         { & $script } | Should -Throw -ErrorId $errorid
     }
 
+
+    It "Sets securitydescriptor of service using Set-Service " {
+        Set-Service -Name $TestServiceName1 -SecurityDescriptor $SecurityDescriptorSddl
+        $Counter      = 0
+        $ExpectedSDDL = ConvertFrom-SddlString -Sddl $SecurityDescriptorSddl
+
+        # Selecting the first item in the output array as below command gives plain text output from the native sc.exe.
+        $UpdatedSDDL  = ConvertFrom-SddlString -Sddl (sc sdshow $TestServiceName1)[1]
+
+        $UpdatedSDDL.Owner | Should -Be $ExpectedSDDL.Owner
+        $UpdatedSDDL.Group | Should -Be $ExpectedSDDL.Group
+        $UpdatedSDDL.DiscretionaryAcl.Count | Should -Be $ExpectedSDDL.DiscretionaryAcl.Count
+        $UpdatedSDDL.DiscretionaryAcl | ForEach-Object -Process {
+            $_ | Should -Be $ExpectedSDDL.DiscretionaryAcl[$Counter]
+            $Counter++
+        }
+    }
+
     It "Set-Service can change '<parameter>' to '<value>'" -TestCases @(
         @{parameter = "Description"; value = "hello"},
         @{parameter = "DisplayName"; value = "test spooler"},
@@ -142,12 +168,12 @@ Describe "Set/New/Remove-Service cmdlet tests" -Tags "Feature", "RequireAdminOnW
         try {
             $startUsername = "user1"
             $endUsername = "user2"
-            $testPass = "Secret123!"
             $servicename = "testsetcredential"
-            net user $startUsername $testPass /add > $null
-            net user $endUsername $testPass /add > $null
-            $password = ConvertTo-SecureString $testPass -AsPlainText -Force
-            $creds = [pscredential]::new(".\$startUsername", $password)
+            $Password = ([char[]]([char]33..[char]95) + ([char[]]([char]97..[char]126)) + 0..9 | Sort-Object {Get-Random})[0..12] -join ''
+            $testPass = (New-Object -TypeName Net.NetworkCredential("", $Password)).SecurePassword
+            $creds = [pscredential]::new(".\$endUsername", $testPass)
+            net user $startUsername $creds.GetNetworkCredential().Password /add > $null
+            net user $endUsername $creds.GetNetworkCredential().Password /add > $null
             $parameters = @{
                 Name           = $servicename;
                 BinaryPathName = "$PSHOME\pwsh.exe";
@@ -159,7 +185,6 @@ Describe "Set/New/Remove-Service cmdlet tests" -Tags "Feature", "RequireAdminOnW
             $service = Get-CimInstance Win32_Service -Filter "name='$servicename'"
             $service.StartName | Should -BeExactly $creds.UserName
 
-            $creds = [pscredential]::new(".\$endUsername", $password)
             Set-Service -Name $servicename -Credential $creds
             $service = Get-CimInstance Win32_Service -Filter "name='$servicename'"
             $service.StartName | Should -BeExactly $creds.UserName