How to set SID of security descriptor of windows service at runtime.

[weanich_s]

 I want to configure the user that obtain from UI to be able to start/stop service that install by InstallShield. I see the permission under System Configurations => Services => Permissions which I can add the security descriptor 

like this O:<[%USERDOMAIN]\[%USERNAME]>G:BAD:(D;OICI;GA;;;BG)(A;OICI;GRGWGX;;;<[%USERDOMAIN]\[%USERNAME]>)(A;OICI;GA;;;BA)S:ARAI(AU;SAFA;FA;;;WD)

according to help file said "You can use angle brackets (for example, <DomainName\UserName>) or environment variables (for example, [%UserDomain][%UserName]) to indicate the domain and user name of the user whose account SID is going to be determined at run time."

https://docs.revenera.com/installshield24helplib/helplibrary/IDlgSDDL.htm

it supports only environment variables which different from file and registry permission that we can use [PROPERTY] to set it at runtime.

My question are

1. Can we use Property to configure the security descriptor to set the value at runtime which value is from user input?

2. If not. How can I use the Environment Variable to configure the security descriptor?

3. Are there any examples, install scripts that support this case?

Thanks 🙂