Link to home
Create AccountLog in
Avatar of RobbieBarns
RobbieBarnsFlag for United States of America

asked on

Service Logon Only Works As Administrator

Hi All - I have a service running on our Windows 2003 Server system that runs great when it logs on as Administrator.   I would much rather have it run as a different user.   I created a new user and added the user to the Administrators group.  Now when the service tries to logon it fails with a COMException error 80004005.   Switching the service back to Administrator and it works great.  Interestingly when the service runs on an XP or Vista machine it runs fine with the new user.  First question is are there capabilities that 'Administrator' has beyond what you get by being in the Administrator group?  Is it possible to add those capabilities to the new user?  Apparently, Service Logon is one of those.  Finally, I understand that a likely meaning of the 80004005 is a permission violation.  I have every directory where something resides for the service set to have full control for the Administrators group, but no luck.  Thanks in advance...
SOLUTION
Avatar of Brian Pierce
Brian Pierce
Flag of United Kingdom of Great Britain and Northern Ireland image

Link to home
membership
Create a free account to see this answer
Signing up is free and takes 30 seconds. No credit card required.
See answer
Avatar of RobbieBarns

ASKER

Thanks for trying - tried it.  No luck, it told me that it was add "logon as a service" to the new/copied user but get the same error when it tries to logon.
SOLUTION
Link to home
membership
Create a free account to see this answer
Signing up is free and takes 30 seconds. No credit card required.
HI - the COM object that is being run by the service is Visual Fox Pro 9 COM Server (exe).  The error I get references the OnStart method of the COM object where database opens and writes are taking place to the server that the service is running on.  I've double-checked those directories to be sure that the Administrators group has Full Control on each and they do.

I implemented the advice of a previous post so that now the ServiceLogonUser belongs to the Administrators, Domain Admins, Domain Users, Enterprise Admins, Group Policy Creator Owners and Schema Admins - groups.

A later method in the COM server also reads and renames files on another 2003 server outside of it's domain.  I tried adding Modify permissions to the file directories on that machine for Enterprise Admins of the home domain (the domain where the service is running).  Could this be the area of the problem?  The home Administrator still works and the new ServiceLogonUser doesn't.
My guess is that this line is where you might be having problems ... "where database opens and writes are taking place "  ... How are you connecting to the database?  My guess is that something is trying to use the account that is running the code to conenct to the database and it cannot do that now.
So I've taken out ALL logic out of the COM object.  Even the HELPSTRINGs, even tried taking out the lines that I think were critical:

SYS(2335, 0)
SYS(2340, 1)

And same error with ServiceLogonUser and fine with Administrator.  The only things in the object are PROCEDURE names, RETURN, ENDPROC lines.  Same problem.  Interestingly, taking out the 4 variable definitions 'myvar1=0' lines at the top create memory violations when missing (I'm guessing I'd need to re-register the COM object to get rid of these).

I"m wondering if the C# logic in the installer class needs more for non-Administrator users:

            this.serviceProcessInstaller1.Account =  ServiceAccount.NetworkService;
            this.serviceProcessInstaller1.Username = "";
            this.serviceProcessInstaller1.Password = "";

Any help is greatly appreciated!  Do we know for sure that Windows Server 2003 supports user defined logon names?


Any success with this?
I was thinking baout this and it could very well be a permissions issue with the COM object or something along those lines ... i ran into problems a while back where permissions for executing code were removed from some of my IIS servers.
ASKER CERTIFIED SOLUTION
Link to home
membership
Create a free account to see this answer
Signing up is free and takes 30 seconds. No credit card required.