"Windows Service Hardening" compartmentalizes the services such that if one service is compromised, it cannot easily attack other services on the system. It prevents Windows services from doing operations on file systems, registry or networks which they are not supposed to, thereby reducing the overall attack surface on the system and preventing entry of malware by exploiting system services. Services are now assigned a per-service Security identifier (SID), which allows controlling access to the service as per the access specified by the security identifier. A per-service SID may be assigned during the service installation via the "ChangeServiceConfig2" API or by using the codice_1 command with the "sidtype" verb. Services can also use access control lists (ACL) to prevent external access to resources private to itself.