Starting Service with Network Service Acct

[gotnetdude]

How do I start a Window Service with the log in set to Network Service. I am log onto my local machine as a domain user and as an administrator on my local machine.

 

[gotnetdude]

You must be able to start the service with the account type of network service. Right? Why else would they have it as an account type unless the service can be started. That would be point less.

 

[JohnH]

For initial configuration you select the Account property on ServiceProcessInstaller. After deploment you can change the account to use in Control Panel, Administrative, Services. Bring up Logon tab in Properties dialog for service and either write the the correct account name or search it up by clicking 'browse' and 'advanced' buttons. When I select this account it displays as "NT AUTHORITY\NetworkService", this account doesn't have a password.

 

[gotnetdude]

Thanks for the reply. I had not tried using the LocalService account type in the service account property on ServiceProcessInstaller. I had tried every other option available for service account (Network Service, LocalSystem, User), but not LocalService. After changing the service account property in the ServiceProcessInstaller to LocalService, I installed the service. I navigated to the Logon Tab for the service. The properties log on account indicated "NT AUTHORITY\Localservice". Both the Password and confirm password dialog boxes contained values. I tried starting the service with password and without passwords, but received the following error message:

Could not start the FanacSyncService service on local computer Error 5; Access is denied.

If I follow the same process as above, but set the service account property to NetworkService I get the same error message.

From the Logon tab in Properties dialog for Services under browse (for the local machine), advanced does contain "Local Service" and "NETWORK SERVICE" Users.

I can start both localsystem and user service account types.

Any idea why I'm not able to start the other services?

 

[JohnH]

"LocalSystem" was a copy-paste error I think, changed to NetworkService as intended, but you get the idea.
What OS you got?

 

[gotnetdude]

The operating system I am using is XP SP2.

It might be worth mentioning that I'm developing the window service with vs05 and .net 2.0

 

[JohnH]

Both the Password and confirm password dialog boxes contained values. I tried starting the service with password and without passwords

The password/confirm boxes in service properties dialog displays lots of 'hide password' characters. You have to write a password to be able to press 'ok' else the dialog give error "incorrect password". For account with no password like NetworkService you have to erase these characters to submit the empty password. For incorrect password you get logon error 1069 when attempting to start.

Could not start the FanacSyncService service on local computer Error 5; Access is denied.

This error was given in a message box, right? Does the event log have any information? "Access denied" is related to security of some sort.

You might want to read more about service accounts at MSDN.

 

[gotnetdude]

The account type in network service and I removed the passwords. When I attempted to start the service the following system event error log was created:

The event system event log had the contained this error message:

The FanacSyncService service failed to start due to the followin error:
Access Denied

 

[gotnetdude]

Event id 7000

Based on the event log I ran the following command:

sc query fanacsyncservice

I received the following information:

Service_name: fanacsyncservice
type: 10 win32_own_process
state: 1 stopped <not_stoppable, not_possible, ignores_shutdown)
win32_exit_code: 0 <0x0>
Service_exit_code: 0 <0x0>
Checkpoint: 0x0
Wait_hint: 0x0

The help message ther referred me to using the sc command indicated "If the Win32_Exit_Code is 0 (which mine is), then SCm did not attempt to start the service because the error was detected first.

The help action are as follows:

1) Review the error information displayed in the message which was:

The FanacSyncService service failed to start due to the followin error:
Access Denied

2) Verify that the service is in the correct location

The FanacSyncService.exe is in c:\documents and settings\user\my documents\visual studio 2005\projects\fanacsyncservice\bin\debug. From the service properties general tab the path to executable matches the location of the executable.

3) Verify the service is not infected with virus.

No virus

Any ideas?

 

[gotnetdude]

Ya! It's started.

I added to the folder containing the fanacsyncservice.exe the network service account.

Am I correct in assuming that a network service account type window service running on say computer A will have the necessary permissions to write to a log file on computer B ( both computers share a common domain)? I shared the folder I trying to write to on computer B, giving full control to the Network Service account. After starting the service I get the following error message:

DirectoryNotFoundException was unhandled

Could not find part of the path 'e:\fanacSync.txt'.

Here is the executable code that's failing the fanacsyncservice.exe application;

system.io.file.appendalltext("e:\fanaccsync.txt", "test completed on - " & now.tostring())

Any ideas?

 

[JohnH]

Drive "E:"? That must be a user mapping you have made for your desktop account to the network share. Try "\\server\resource\file.txt".

 

[gotnetdude]

I modified the FanacSyncServic.vb code as follows:

system.io.file.appendalltext(''\\sn9218\fanacdatabase\fanacsync.txt", "FanacSync db - tested at: " & now.tostring())

The service errored out with win32_exit_code of 1067

When I tried to debug the error I received the following error message:

Unable to attach to the crash process, you do not have permission to inspect the process's identy.

I search google but it was all general information stuff.

I created a test win console program with the same code and received the following error message:

System.UnauthorizedAccessException: Access to the path: '\\sn9218\fanacdatabase\fanacsync.txt' is denied

Does this have something to do with the application not having full trust on the remote pc? Any thoughts?

 

[gotnetdude]

When I used the LocalService account previously with use disk option checked, I was getting the same access denied error message. Does anyone know for sure whether this can be done. Has anyone done this?

 

[JohnH]

From the link I posted earlier it looks like the share must grant access to Everyone, is this true with your share?

Also noticed this you wrote earlier:

trying to write to on computer B, giving full control to the Network Service account

The NetworkService account is a local machine account, you can give this account access on one machine and expect other machines NetworkService accounts to have same access, because they are not same account.

 

[gotnetdude]

Yes! That was it I granted everyone full permission and it worked. Thank you so much.

I Thought it was running under the network service account. I had given it that account full control. Go figure, it was running under everyone. Thanks again