<div>
you might wanna try try some tool that would reveal the passwords masked by the &quot;asterisks&quot; &nbsp;.. like asteriskkey .. <br />
<a href="http://www.snapfiles.com/get/asteriskkey.html" rel="ugc">http://www.snapfiles.com/get/asteriskkey.html</a>&nbsp;<br />

</div>


<div>
The password in the service properties are just dummy asterisks (note how the number changes form the real number of letters when you re-open the dialog); you won't be able to reveal those.<br />
Did you give the account you want to use the &quot;Logon as service&quot; user right? Setting a user account in services.msc will automatically assign this right, any other way to change the service configuration will not do so.<br />
And on a side note: do *NOT* use an account that is used for interactive logons as a service account as well. Create a dedicated service account, and give it only the minimum set of permissions it needs.<br />

</div>


<div>
The problem you might have is that you have a GPO that restricts the run as service/logon as service to a subset of credentials, but this account is not included in the list. &nbsp;When the GPO is refreshed, the account will not be allowed to start the service.<br />
The difference when you set the password, the account is added to allow logon on the local system until the GPO refresh. &nbsp;The service will continue to run, but should the system reboot or the service needs to be restarted, the servicce will again fail to start.
</div>


<div>
ok..here's a basic one...<br />
How do I view the list of accounts that are allowed to run as service/logon?Also, are you referring to the local GPO or domain one?
</div>


<div>
This can be configured either through a local or a domain policy (the latter has priority, if applied).<br />
Check the local policy first; start secpol.msc, go to Windows Configuration\Security Settings\Local Policies\User rights assignment, &quot;Logon as service&quot;. If you can't edit it, it's coming from the domain (then you'll have to use the GPMC, gpresult /v, or rsop.msc to find out where it's coming from). The default is &quot;Network Service&quot;.
</div>


<div>
the local policy is &quot;Network Service&quot; - what does this mean?<br />
Where do I find the domain policy? I'm in AD -&gt; Users and computers-&gt; Group policy-&gt;edit<br />
Where do I look at?<br />
Thanks for your patience and feel free to point me to a RTFM..
</div>


<div>
ok.. I think I found it on the DC (administrative tools-&gt;domain security policy-&gt; local policies-&gt;user rights assignment)...<br />
&quot;Logon as a service&quot; isn't defined...<br />
So when I change the passwd manually (back to the begining of the thread) where does it add an entry? in the local security policy or the domain one?
</div>


<div>
You have to use the GPMC tool <br />
<a href="http://www.microsoft.com/windowsserver2003/gpmc/default.mspx" rel="ugc nofollow">http://www.microsoft.com/windowsserver2003/gpmc/default.mspx</a><br />
This tool will layout your AD domain structure along with which GPO is linked to which OU.<br />
I.e. you have GPO that apply to everything within the domain unless specifically excluded (deny inheritance). &nbsp;Then you have Organizational Units to which a more specific set of GPO applies. &nbsp;This is usually done to get a more drilled down control over systems/users in the specific GPO.
</div>


<div>
If you apply a local policy that limits logon as a service to network service only, this is the problem.<br />
Usually, it is better to manage systems through Domain GPO versus going to local policy on each individual system.<br />
<br />
If you still want to continue using the local policy, add the account of this service to the logon as service entry in the local policy.
</div>


<div>
Is the machine you're installing this service on actually the DC, or is it a domain member?<br />
When you set the account to use using services.msc, the account will be added to the *local* user rights. You can add the account manually to this user right as well. But if you're doing this on a DC, do NOT use secpol.msc, use the &quot;Security Policy for Domain Controllers&quot;.
</div>


<div>
1. The machine I'm installing the service is a domain member<br />
2. I've verified that after manually setting the password in the control panel, I can see that this user was added to the &quot;log on as a service&quot; on the local security policy.<br />
<br />
<br />
You've been very helpful!!!<br />
<br />

</div>


<div>
The problem could be that the account is being removed by a GPO refresh.<br />
I.e. you have a restricted group or you have a Domain based GPO that limits which accounts can be used in this fashion. &nbsp;You should use GPMC to generate results for the member server to see which GPOs get applied and their implication. You are looking for the GPO that explicitly sets groups/accounts in the log on as a service as well as other option depending on which type of account and application it is. I.e. allow to lock memory pages, etc.
</div>


<div>
worldpeace,<br />
when you open the properties of the &quot;Logon as service&quot; in secpol.msc, can you click the &quot;Add user or group&quot; and/or the &quot;Remove&quot; button? If so, then there's no domain policy configuring this.<br />
Do you still have problems after configuring the service account manually?<br />

</div>


<div>
Yes, I can click the &quot;Add user or group&quot; ..<br />
Thanks.<br />
I'm actually an ISV developing this program - <br />
Any idea what's the &nbsp;API I need to use in order to insure that the user being entered during the installation will be added to the local security policy / domain security policy and allowed to &quot;logon as service&quot;?
</div>


<div>
<div class="content wysiwyg-content">
Hello,<br />
Is there a way for me to view what password is being used by a Service?<br />
Background:<br />
I'm installing a piece of sw which installs as a service. The installation process asks me for domain admin credentials. I'm putting in the right ones (verified multiple times) but the service fails to start with a &nbsp;&quot;log on failure&quot; error message &nbsp;(0x42d).<br />
When I go into the service panel, and manually change / update the passwd (to the same one entered during the installation process) the service s able to start ok.<br />
Thanks in advance!<br />

</div>
</div>


Hello,
Is there a way for me to view what password is being used by a Service?
Background:
I'm installing a piece of sw which installs as a service. The installation process asks me for domain admin credentials. I'm putting in the right ones (verified multiple times) but the service fails to start with a  "log on failure" error message  (0x42d).
When I go into the service panel, and manually change / update the passwd (to the same one entered during the installation process) the service s able to start ok.
Thanks in advance!


How can I view what password is being used by a Service?

Windows Server 2003 was based on Windows XP and was released in four editions: Web, Standard, Enterprise and Datacenter. It also had derivative versions for clusters, storage and Microsoft’s Small Business Server. Important upgrades included integrating Internet Information Services (IIS), improvements to Active Directory (AD) and Group Policy (GP), and the migration to Automated System Recovery (ASR).

Windows Server 2003

The Microsoft Legacy Operating System topic includes legacy versions of Microsoft operating systems prior to Windows 2000: All versions of MS-DOS and other versions developed for specific manufacturers and Windows 3/3.1, Windows 95 and Windows 98, plus any other Windows-related versions, and Windows Mobile.

Microsoft Legacy OS

This topic area includes legacy versions of Windows prior to Windows 2000: Windows 3/3.1, Windows 95 and Windows 98, plus any other Windows-related versions including Windows Mobile.