Problem with service

I tried to add my service name to
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
as described in that article
Now the VisualStudio says:

Unable to attach to the process. You do not have permission to inspect the process's identity.

Set the service to run under the account you are logging on or launch Visual Studio with the SE_DEBUG_NAME privilege enabled, i.e.

BOOL EnablePrivilege(PCSTR name)
{
    TOKEN_PRIVILEGES priv = {1, {0, 0, SE_PRIVILEGE_ENABLED}};
    LookupPrivilegeValue(0, name, &priv.Privileges[0].Luid);

    HANDLE hToken;
    OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &hToken);

    AdjustTokenPrivileges(hToken, FALSE, &priv, sizeof priv, 0, 0);
    BOOL rv = GetLastError() == ERROR_SUCCESS;

    CloseHandle(hToken);
    return rv;
}

EnablePrivilege(SE_DEBUG_NAME);
ShellExecute(NULL,"open","dexplore.exe",NULL,NULL,SW_SHOW);

Sorry, I don't understand that.
Your code, from where should I execute it? Just to create a starter process and to ran the VisualStudio from it?
dexplore.exe is a help browser. It should be "devenv.exe", right?

When the service tries to run with my identities, not even a single line of it is executed and DebugBreak() seems is not call neither. "sc start mysvc" command exits immediately.

When the service uses local system account it calls DebugBreak(), the  the Just-in-time debugger dialog appears and then I'm unable to attach the debugger with the error I mentioned above.

I'm not an administrator, but I gave myself "Debug Programs", "Act as part of operation system" and "Logon as a service" rights.
Should I reboot? Should I enable something else? Or should I just be an administrator?

>>Just to create a starter process and to ran the VisualStudio from it?

Yes, that's the idea. BTW, the provilege is granted to all admin users, yet it is not enabled, which that starter does prior to launch the target process.. If you create such a starter to launch e.g. taskmgr.exe, you will also be able to kill services using the task manager.

>>dexplore.exe is a help browser. It should be "devenv.exe", right?

Sorry, yes "devenv.exe" is what you start.

No, the same result.
BTW, I used Sysinternals' ProcessExplorer and I compared the SeDebugPrivelege for
the devenv.exe launched from your starter and the regular way, they are the same.

I tried to use taskmgr.exe to kill a process, lunched by the administrator, it was succeeded (I was unable to do it before).
So, I guess I have already enough rights to kill a process, but not to inspect the process's identity.

Guess, I need to become an Administrator. Will try.

Yes, I have. As I mentioned before in this case "sc start mysvc" command exits immediately and having the DebugBreak() call in the code does not cause to launch Just-in-time debugger.

BTW, what does that service do? Maybe it really is stuck at aquiring some resource that is not available. That might help diagnosing the problem if you can get it debugged...

I got the possibility to debug it by including myself into the Administrators group. It is not good but I have no time to investigate more.

The application does a lot of stuff. It has many threads, connects to some feeds, works with a database, dispense data to clients. So it might be a pitfall in any part of it. But it worked as a service a year ago. We used to launch it as a console application to simplify debugging, but now we need to switch back to the service version...

>>I got the possibility to debug it

Good, that should help.

I still  have a number of questions:

PreMessageLoop() calls RegisterClassObjects(), which returns E_FAIL, and the the main loop does not start. Can I just override RegisterClassObjects() to return S_OK ?
Does the RegisterClassObjects() intent to do something important? Why it need for?

My application has some kind of peculiarity: the main thread should be not given up forever (because some third party library we use has a static object and it has to instantiate and be accessible in the same thread). That's mean I can not let the ATL's Start() call ::StartServiceCtrlDispatcher().
So, I overrode the Start() method and I create a new thread in it, and then, in the new thread I call the ATL's Start(). In this way the service control dispatcher works in my new thread but not in the main thread.
I'm asking, because I'm not sure how to initialize COM.
I implemented InitializeCom() but it's never called and I got  0x800401f0 error (CO_E_NOTINITIALIZED). The service only works if call CoInitializeEx() in the main thread, before I create thread for the dispatcher.
Can you suggest a better way to do this?

One more question: CAtlServiceModuleT<>::Start() has a parameter - how to show the window. What's mean 'window' for a service? It's little confusing.

>>PreMessageLoop() calls RegisterClassObjects(), which returns E_FAIL

Um that'S where I'd actually start looking for the problem - why does that fail?

>>So, I overrode the Start() method and I create a new thread in it, and then, in
>> the new thread I call the ATL's Start(). In this way the service control >>dispatcher works in my new thread but not in the main thread.

At first glance 'COINIT_MUTITTHREADED', but since you hancen't changed anything, I am wondering...

>>One more question: CAtlServiceModuleT<>::Start() has a parameter - how
>>to show the window

Since a service has no GUI, don't bother.

> Um that'S where I'd actually start looking for the problem - why does that fail?

It iterates from _ATL_COM_MODULE70::m_ppAutoObjMapFirst to _ATL_COM_MODULE70::m_ppAutoObjMapLast
(atlbase.inl:170 (VS2005)), if there is no entry in the maps, it returns S_FALSE; Have no idea what is that for.

> At first glance 'COINIT_MUTITTHREADED', but since you hancen't changed
> anything, I am wondering...
Actually, I do call CoInitializeEx() with COINIT_MULTITHREADED flag in every thread. I works.

> Since a service has no GUI, don't bother.
What's the best practice to attach to a service an UI?
Currently, I have a console app which connects to my service via a named pipe. Is there a better way?

Any chance that a module that your service is relying on is missing on the target machine? Do you have more details on the map entry it is failing on?

>>Currently, I have a console app which connects to my service via a named
>>pipe. Is there a better way?

No, that is actually the preferred way to do that. Granting your service access to the desktop opens up potential security loopholes, so I'd rather keep the approach.