Why would a Windows service not be able to access the Running Object Table

Question

I have a Windows service running in the background and I want at some point to tell him to get objects from the Running Object Table.

The problem is that it seems impossible to achieve, whatever I try.

It always fails at the GetObject method from the Windows API, failing with code 0x‭800401E3‬ (Operation unavailable) as if the object did not exist.

• The same code sample that fails in the service does work fine in a regular executable therefore a typo or a logical error is quite unlikely.

• I tried running the service the following ways :

  • On local system account
  • On admin user account
  • On local system account impersonating admin user (using ImpersonateLoggedOnUser)
    • They all failed the same way (as described above, on GetObject method)

So I am wondering whether there are limitations I am not aware regarding the Running Object Table and Windows services (for possible security issues ?).

And well, if it is suppose to work, what could I be missing ? Is there something else than user privileges that could tamper with the ability of my service to see/retrieve data from the Running Object Table ?