Solved

Service Logon Only Works As Administrator

Posted on 2008-06-12
9
265 Views
Last Modified: 2010-04-20
Hi All - I have a service running on our Windows 2003 Server system that runs great when it logs on as Administrator.   I would much rather have it run as a different user.   I created a new user and added the user to the Administrators group.  Now when the service tries to logon it fails with a COMException error 80004005.   Switching the service back to Administrator and it works great.  Interestingly when the service runs on an XP or Vista machine it runs fine with the new user.  First question is are there capabilities that 'Administrator' has beyond what you get by being in the Administrator group?  Is it possible to add those capabilities to the new user?  Apparently, Service Logon is one of those.  Finally, I understand that a likely meaning of the 80004005 is a permission violation.  I have every directory where something resides for the service set to have full control for the Administrators group, but no luck.  Thanks in advance...
0
Comment
Question by:RobbieBarns
  • 4
  • 3
9 Comments
 
LVL 70

Assisted Solution

by:KCTS
KCTS earned 100 total points
ID: 21767067
If it must run with administrator permissions then in ADUC right click on Administrator and select Copy to create a new account - this will then have all the memberships that Administrator has, (Administrators, Domain Admin, Enterprise Admin, Schema Admin, GP Creator/Owner) and use that.
0
 

Author Comment

by:RobbieBarns
ID: 21767138
Thanks for trying - tried it.  No luck, it told me that it was add "logon as a service" to the new/copied user but get the same error when it tries to logon.
0
 
LVL 22

Assisted Solution

by:cj_1969
cj_1969 earned 100 total points
ID: 21874790
As noted, this appears to be a permissions issue.
If not file based, is there any communications taking place?  DB access or something?
Being a member of hte administrator's group should give access to all of the functionality of the machine but if there is user level access to a resources (such as a database) then this could/would be controlled by the actual user ID that the service is running under.

Based on this ... http://www.experts-exchange.com/Microsoft/Applications/Microsoft_Dynamics/Q_22932717.html
I believe you have a permissions issue ... something is configured to authenticate the user account and not by group.
0
Netscaler Common Configuration How To guides

If you use NetScaler you will want to see these guides. The NetScaler How To Guides show administrators how to get NetScaler up and configured by providing instructions for common scenarios and some not so common ones.

 

Author Comment

by:RobbieBarns
ID: 21878607
HI - the COM object that is being run by the service is Visual Fox Pro 9 COM Server (exe).  The error I get references the OnStart method of the COM object where database opens and writes are taking place to the server that the service is running on.  I've double-checked those directories to be sure that the Administrators group has Full Control on each and they do.

I implemented the advice of a previous post so that now the ServiceLogonUser belongs to the Administrators, Domain Admins, Domain Users, Enterprise Admins, Group Policy Creator Owners and Schema Admins - groups.

A later method in the COM server also reads and renames files on another 2003 server outside of it's domain.  I tried adding Modify permissions to the file directories on that machine for Enterprise Admins of the home domain (the domain where the service is running).  Could this be the area of the problem?  The home Administrator still works and the new ServiceLogonUser doesn't.
0
 
LVL 22

Expert Comment

by:cj_1969
ID: 21885263
My guess is that this line is where you might be having problems ... "where database opens and writes are taking place "  ... How are you connecting to the database?  My guess is that something is trying to use the account that is running the code to conenct to the database and it cannot do that now.
0
 

Author Comment

by:RobbieBarns
ID: 21891534
So I've taken out ALL logic out of the COM object.  Even the HELPSTRINGs, even tried taking out the lines that I think were critical:

SYS(2335, 0)
SYS(2340, 1)

And same error with ServiceLogonUser and fine with Administrator.  The only things in the object are PROCEDURE names, RETURN, ENDPROC lines.  Same problem.  Interestingly, taking out the 4 variable definitions 'myvar1=0' lines at the top create memory violations when missing (I'm guessing I'd need to re-register the COM object to get rid of these).

I"m wondering if the C# logic in the installer class needs more for non-Administrator users:

            this.serviceProcessInstaller1.Account =  ServiceAccount.NetworkService;
            this.serviceProcessInstaller1.Username = "";
            this.serviceProcessInstaller1.Password = "";

Any help is greatly appreciated!  Do we know for sure that Windows Server 2003 supports user defined logon names?


0
 
LVL 22

Expert Comment

by:cj_1969
ID: 22059200
Any success with this?
I was thinking baout this and it could very well be a permissions issue with the COM object or something along those lines ... i ran into problems a while back where permissions for executing code were removed from some of my IIS servers.
0
 

Accepted Solution

by:
RobbieBarns earned 0 total points
ID: 22071975
Thanks for thinking about it, but this is just running and an internal LAN and so I don't think that IIS is involved.
0

Featured Post

VMware Disaster Recovery and Data Protection

In this expert guide, you’ll learn about the components of a Modern Data Center. You will use cases for the value-added capabilities of Veeam®, including combining backup and replication for VMware disaster recovery and using replication for data center migration.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Welcome to my series of short tips on migrations. Whilst based on Microsoft migrations the same principles can be applied to any type of migration. My first tip Migration Tip #1 – Source Server Health can be found here: http://www.experts-exchang…
While rebooting windows server 2003 server , it's showing "active directory rebuilding indices please wait" at startup. It took a little while for this process to complete and once we logged on not all the services were started so another reboot is …
Two types of users will appreciate AOMEI Backupper Pro: 1 - Those with PCIe drives (and haven't found cloning software that works on them). 2 - Those who want a fast clone of their boot drive (no re-boots needed) and it can clone your drive wh…
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …

830 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question