BCUninstaller/Bulk-Crap-Uninstaller · error · SecurityException

The user does not have the necessary access.

Error message

The user does not have the necessary access.

What it means

ServiceEntryFactory.CheckReturnValue inspects the ReturnValue of a WMI Win32_Service method invocation. ReturnValue 2 means 'Access Denied', and the code maps it to a System.Security.SecurityException with message 'The user does not have the necessary access.' This is the WMI-level signal that the calling principal lacks the privileges to stop/start/delete the target service.

Source

Thrown at source/UninstallTools/Startup/Service/ServiceEntryFactory.cs:121

            try { EnableService(serviceName, false); }
            catch (ManagementException) { }

            var classInstance = GetServiceObject(serviceName);

            // Execute the method and obtain the return values.
            var outParams = classInstance.InvokeMethod("Delete", null, new InvokeMethodOptions { Timeout = TimeSpan.FromMinutes(1) });
            CheckReturnValue(outParams, 16); // 16 - Service Marked For Deletion
        }

        private static void CheckReturnValue(ManagementBaseObject outParams, params UInt32[] ignoredCodes)
        {
            if (outParams == null) return;

            var exitCode = (UInt32)outParams["ReturnValue"];
            if (exitCode == 0 || ignoredCodes.Any(x => x == exitCode)) return;

            if (exitCode == 2) // 2 - Access Denied
                throw new SecurityException("The user does not have the necessary access.");

            throw new ManagementException("Action failed with return value " + outParams["ReturnValue"] +
                ". Check return codes of Win32_Service class methods for more information.");
        }

        private static ManagementObject GetServiceObject(string serviceName)
        {
            return new ManagementObject("root\\CIMV2",
                $"Win32_Service.Name='{serviceName}'", new ObjectGetOptions { Timeout = TimeSpan.FromMinutes(1) });
        }
    }
}

View on GitHub (pinned to 608321de98)

Solutions

1. Relaunch the application elevated (requireAdministrator manifest or a restart-as-admin flow) before performing service operations.
2. Before acting, query the service's access rights with ServiceController.GetServices / NativeMethods.QueryServiceObjectAccess and skip/disable the action if the required right is missing.
3. Catch SecurityException specifically and prompt the user to restart as administrator.

Example fix

// before
ServiceEntryFactory.Delete(serviceEntry);

// after
if (!HasElevation)
{
    RestartAsAdmin();
    return;
}
try { ServiceEntryFactory.Delete(serviceEntry); }
catch (SecurityException) { Prompt("Relaunch as administrator to manage this service."); }

if (!IsProcessElevated())
    throw new SecurityException("Service management requires elevation.");
ServiceEntryFactory.Delete(serviceEntry);

null

try { ServiceEntryFactory.Delete(serviceEntry); }
catch (SecurityException)
{
    PromptRelaunchAsAdmin();
}

When it happens

Trigger: Invoking a service management action (e.g. the Delete path that calls InvokeMethod("Delete", ...)) on a service while the process is not elevated, or while the user lacks the SCM permission (SERVICE_STOP / SERVICE_DELETE) on that service, returning ReturnValue 2.

Common situations: App run without admin rights and trying to act on a system service; UAC elevation declined; the service's security descriptor grants the principal only read access; acting on a service owned by TrustedInstaller.

Related errors

• Action failed with return value {outParams["ReturnValue"]}.
• Access is denied. Indicates that user has no access right to
• Win32_Directory.Compress returned {ret}
• Error while collecting Windows Features. If Windows Update i
• WMI query has hung while collecting Windows Features, try re

AI-assisted analysis of BCUninstaller/Bulk-Crap-Uninstaller@608321de98 (2026-08-13). Data as JSON: /api/errors/ed02af1a385254a8. Report an issue: GitHub.