problems starting a Network service

[sunil]

Hi,
I have a service written in c# that I need to run as a "Network
Service". I am using a setup project to install the service.
If I install the service in User's Personal Folder, I get the following
error:
"Could not start the <servicenameser vice on Local Computer. Error 5:
Access is denied."

If I install the service in ProgramFiles folder, I get the following
error:
"The <servicenameser vice on Local Computer started and then stopped.
Some services stop automatically if they have no work to do"

The service runs fine under the "Local System" account.

[Marc Gravell]

Re: problems starting a Network service

Well, have you tried getting your service to tell you what is wrong?
perhaps catch some exceptions and log the real error to the event log?
It would also help to know what your service is attempting to do...
for instance, if it is trying to log onto a protected resource using
the NT identity, then note that it will be using the *computer*
identity (via "network service"), and not the identity of any user. If
you need protected access, one option is to run as a specific user.

Marc

[sunil]

Re: problems starting a Network service


Marc Gravell wrote:

Well, have you tried getting your service to tell you what is wrong?
perhaps catch some exceptions and log the real error to the event log?
It would also help to know what your service is attempting to do...
for instance, if it is trying to log onto a protected resource using
the NT identity, then note that it will be using the *computer*
identity (via "network service"), and not the identity of any user. If
you need protected access, one option is to run as a specific user.
>
Marc

Hi Marc,
I gave the exception handler. The exception caught is
InvalidOperatio nException if the service is installed in user's
Personal folder. If the service is installed in Program Files folder,
then the exception caught is TimeOutExceptio n.
I tried to start the service from the Service Controller Manager. The
behavior is the same.
Thanks for the response

[Marc Gravell]

Re: problems starting a Network service

You haven't really indicated what your service might be attempting to
do... if you are (as you suggest) successfully catching exceptions in
your managed code, then some clue as to what the exception handler
*surrounds* will probably tell you what isn't working...

Marc

[Ignacio Machin \( .NET/ C# MVP \)]

Re: problems starting a Network service

Hi,

"sunil" <sairaj.sunil@g mail.comwrote in message
news:1167743599 .124131.301820@ a3g2000cwd.goog legroups.com...

Hi Marc,
I gave the exception handler. The exception caught is
InvalidOperatio nException if the service is installed in user's
Personal folder.

Well this is pretty evidend, you are not installing it under an user account
but under network service.

>If the service is installed in Program Files folder,
then the exception caught is TimeOutExceptio n.
I tried to start the service from the Service Controller Manager. The
behavior is the same.

Can you post some code? at least the code you use in the onStart method


--
Ignacio Machin
machin AT laceupsolutions com

[sunil]

Re: problems starting a Network service


Marc Gravell wrote:

You haven't really indicated what your service might be attempting to
do... if you are (as you suggest) successfully catching exceptions in
your managed code, then some clue as to what the exception handler
*surrounds* will probably tell you what isn't working...
>
Marc

Hi Marc,
In the onstart() method, I am trying to open a configuration file(XML
file) and then based on the content of the files, I initialize few
things. I am not accessing any other resource other than the
configuration file
May be, I can understand the reason for the failure in the case where I
installed the service in user's personal data folder(access denied is
being thrown).
But if the service is to be installed in program files folder, why is
it that the error is thrown
Thanks for the response

[Willy Denoyette [MVP]]

Re: problems starting a Network service

"sunil" <sairaj.sunil@g mail.comwrote in message
news:1167753500 .852480.137430@ n51g2000cwc.goo glegroups.com.. .

>
Marc Gravell wrote:

>You haven't really indicated what your service might be attempting to
>do... if you are (as you suggest) successfully catching exceptions in
>your managed code, then some clue as to what the exception handler
>*surrounds* will probably tell you what isn't working...
>>
>Marc

>
Hi Marc,
In the onstart() method, I am trying to open a configuration file(XML
file) and then based on the content of the files, I initialize few
things. I am not accessing any other resource other than the
configuration file
May be, I can understand the reason for the failure in the case where I
installed the service in user's personal data folder(access denied is
being thrown).
But if the service is to be installed in program files folder, why is
it that the error is thrown
Thanks for the response
>

OnStart has to start a "service thread" and return within 30 seconds. As far as I
understand, your service is not a service, actually it does nothing else than reading a file
and block or simply return from OnStart. When it blocks, the SCM will time-out, when it
returns whithout having a service thread running it will stop with this :
error:
"The <servicenameser vice on Local Computer started and then stopped.
Some services stop automatically if they have no work to do"

Willy.

[sunil]

Re: problems starting a Network service


Hi all,
thanks everybody for giving such valuable inputs.
I have noticed that, if I install the network service in ProgramFiles
folder, the application log entry showed:
Service cannot be started. System.Unauthor izedAccessExcep tion: Access
to the path 'C:\Program Files\MyService \error.txt' is denied.
Actually what I am doing is to write to a text file, that the
configuration file is loaded. If the text file is not there, I create
it. I think this is where the error occurs.
I tried to create the text file before installing the service, and gave
full control to Users group manually, then there is no problem at all.
The service started successfully.
Basing on this, how can I create a text file,if it does not exist, and
give write permissions to Users group from my program

Thanks once again for the help

[Willy Denoyette [MVP]]

Re: problems starting a Network service

"sunil" <sairaj.sunil@g mail.comwrote in message
news:1167806709 .408072.113860@ k21g2000cwa.goo glegroups.com.. .

>
Hi all,
thanks everybody for giving such valuable inputs.
I have noticed that, if I install the network service in ProgramFiles
folder, the application log entry showed:
Service cannot be started. System.Unauthor izedAccessExcep tion: Access
to the path 'C:\Program Files\MyService \error.txt' is denied.
Actually what I am doing is to write to a text file, that the
configuration file is loaded. If the text file is not there, I create
it. I think this is where the error occurs.
I tried to create the text file before installing the service, and gave
full control to Users group manually, then there is no problem at all.
The service started successfully.
Basing on this, how can I create a text file,if it does not exist, and
give write permissions to Users group from my program
>
Thanks once again for the help
>

The "local service" account has no write access privileges to the "program files" and it's
sub-dirs, so you'll have to grant Write access privileges for "local service" to 'C:\Program
Files\MyService before you can create files into this path.

Willy.

[sunil]

Re: problems starting a Network service

>
The "local service" account has no write access privileges to the "program files" and it's
sub-dirs, so you'll have to grant Write access privileges for "local service" to 'C:\Program
Files\MyService before you can create files into this path.
>
Willy.

Hi,
can you tell me how to do it? or may be direct me to some articles
which discuss it
thanks for the help

[Willy Denoyette [MVP]]

Re: problems starting a Network service

"sunil" <sairaj.sunil@g mail.comwrote in message
news:1167828091 .662790.230190@ 42g2000cwt.goog legroups.com...

>

>>
>The "local service" account has no write access privileges to the "program files" and
>it's
>sub-dirs, so you'll have to grant Write access privileges for "local service" to
>'C:\Program
>Files\MyServic e before you can create files into this path.
>>
>Willy.

>
>
Hi,
can you tell me how to do it? or may be direct me to some articles
which discuss it
thanks for the help
>

The easiest is by running the cacls.exe command-line tool.
Running this:
cacls "C:\Program Files\MyService " /E /G "nt authority\netwo rk service:W"
will edit the ACE and add write perms. to network service to the folder "C:\Program
Files\MyService ".

run help cacls to see all options.

Willy.

[sunil]

Re: problems starting a Network service

The easiest is by running the cacls.exe command-line tool.
Running this:
cacls "C:\Program Files\MyService " /E /G "nt authority\netwo rk service:W"
will edit the ACE and add write perms. to network service to the folder "C:\Program
Files\MyService ".
>
run help cacls to see all options.
>
Willy.

Hi,
I tried that from my command-line, changed the access list and then
started my service. It worked great.
But since I do not know what will be the installation folder
beforehand, I have to change the access list from my program. How do I
do this? I have tried using:

Process myProcess = new Process();
myProcess.Start Info.FileName = "cacls.exe" ;
myProcess.Start Info.Arguments = @"C:\Program Files\MyService " + "/E /G"
+
@"nt
authority\netwo rk service:W";
myProcess.Start ();
myProcess.WaitF orExit();

But this doesn't seem to change the access list. please help me
thanks for the valuable time you have spent for me

[sunil]

Re: problems starting a Network service

The easiest is by running the cacls.exe command-line tool.
Running this:
cacls "C:\Program Files\MyService " /E /G "nt authority\netwo rk service:W"
will edit the ACE and add write perms. to network service to the folder "C:\Program
Files\MyService ".
>
run help cacls to see all options.
>
Willy.

Hi,
I tried that from my command-line, changed the access list and then
started my service. It worked great.
But since I do not know what will be the installation folder
beforehand, I have to change the access list from my program. How do I
do this? I have tried using:

Process myProcess = new Process();
myProcess.Start Info.FileName = "cacls.exe" ;
myProcess.Start Info.Arguments = @"C:\Program Files\MyService " + "/E /G
"
+ @"nt authority\netwo rk service:W";
myProcess.Start Info.UseShellEx ecute = false;
myProcess.Start Info.RedirectSt andardOutput = true;
myProcess.Start ();
EventLog.WriteE ntry(sSource, myProcess.Stand ardOutput.ReadT oEnd());
myProcess.WaitF orExit();

There seems to be a problem. From my application log, I found out that
it is waiting for my reply.
The response written is:Are you sure(y/n)?
How can I send an answer as "y" from my program.
please help me
thanks for the valuable time you have spent for me

[Willy Denoyette [MVP]]

Re: problems starting a Network service

"sunil" <sairaj.sunil@g mail.comwrote in message
news:1167900924 .122884.173680@ 31g2000cwt.goog legroups.com...

>

>The easiest is by running the cacls.exe command-line tool.
>Running this:
>cacls "C:\Program Files\MyService " /E /G "nt authority\netwo rk service:W"
>will edit the ACE and add write perms. to network service to the folder "C:\Program
>Files\MyServic e".
>>
>run help cacls to see all options.
>>
>Willy.

>
Hi,
I tried that from my command-line, changed the access list and then
started my service. It worked great.
But since I do not know what will be the installation folder
beforehand, I have to change the access list from my program. How do I
do this? I have tried using:
>
Process myProcess = new Process();
myProcess.Start Info.FileName = "cacls.exe" ;
myProcess.Start Info.Arguments = @"C:\Program Files\MyService " + "/E /G
"
+ @"nt authority\netwo rk service:W";
myProcess.Start Info.UseShellEx ecute = false;
myProcess.Start Info.RedirectSt andardOutput = true;
myProcess.Start ();
EventLog.WriteE ntry(sSource, myProcess.Stand ardOutput.ReadT oEnd());
myProcess.WaitF orExit();
>
There seems to be a problem. From my application log, I found out that
it is waiting for my reply.
The response written is:Are you sure(y/n)?
How can I send an answer as "y" from my program.
please help me
thanks for the valuable time you have spent for me
>

Well you could redirect stdin and send it a "y" followed by a return, but I hate this idea,
simply because you need a user to interpret the real question.
Much better is do it using the V2 System.Security .AccessControl namespace.
Following is how you could proceed.....

using System.Security .AccessControl;
....

string authority = "nt authority";
string account= "network service";
string path = @"c:\program files\......... ......";
string identity = String.Format(@ "{0}\{1}",
authority , account);
DirectoryInfo di = new DirectoryInfo(p ath);
DirectorySecuri ty ds = di.GetAccessCon trol(AccessCont rolSections.All );
FileSystemAcces sRule fsaRule =
new FileSystemAcces sRule(identity , FileSystemRight s.Write,
AccessControlTy pe.Allow);
ds.AddAccessRul e(fsaRule);
di.SetAccessCon trol(ds);
....

Willy.

[sunil]

Re: problems starting a Network service

>
Well you could redirect stdin and send it a "y" followed by a return, but I hate this idea,
simply because you need a user to interpret the real question.
Much better is do it using the V2 System.Security .AccessControl namespace.
Following is how you could proceed.....
>
using System.Security .AccessControl;
...
>
string authority = "nt authority";
string account= "network service";
string path = @"c:\program files\......... ......";
string identity = String.Format(@ "{0}\{1}",
authority , account);
DirectoryInfo di = new DirectoryInfo(p ath);
DirectorySecuri ty ds = di.GetAccessCon trol(AccessCont rolSections.All );
FileSystemAcces sRule fsaRule =
new FileSystemAcces sRule(identity , FileSystemRight s.Write,
AccessControlTy pe.Allow);
ds.AddAccessRul e(fsaRule);
di.SetAccessCon trol(ds);
...
>
Willy.

Hi,
I had tried out the second suggestion that you have made. It didn't
work out for me.The stack trace is:
Service cannot be started.
System.Security .AccessControl. PrivilegeNotHel dException: The process
does not possess the 'SeSecurityPriv ilege' privilege which is required
for this operation.
at System.Security .AccessControl. Win32.GetSecuri tyInfo(Resource Type
resourceType, String name, SafeHandle handle, AccessControlSe ctions
accessControlSe ctions, RawSecurityDesc riptor& resultSd)
at
System.Security .AccessControl. NativeObjectSec urity.CreateInt ernal(ResourceT ype
resourceType, Boolean isContainer, String name, SafeHandle handle,
AccessControlSe ctions includeSections , Boolean createByName,
ExceptionFromEr rorCode exceptionFromEr rorCode, Object exceptionContex t)
at System.Security .AccessControl. FileSystemSecur ity..ctor(Boole an
isContainer, String name, AccessControlSe ctions includeSections ,
Boolean isDirectory)
at System.Security .AccessControl. DirectorySecuri ty..ctor(String
name, AccessControlSe ctions includeSections )
at System.IO.Direc toryInfo.GetAcc essControl(Acce ssControlSectio ns
includeSections )


For the first suggestion that you have given, I had redirected the
standard input and passed a "y", but the service never entered
"running" state. It is always in StartPending state.
Also the eventlog entries are not being written properly(only the first
one is written)

Process myProcess = new Process();
string accountName = "\"nt authority\\netw ork service\":F";
string argument = '"' +
Directory.GetPa rent(Assembly.G etExecutingAsse mbly().Location ).FullName
+ '"' + @"/E" + @" /G " + accountName;
myProcess.Start Info.FileName = "cacls";
myProcess.Start Info.Arguments = argument;
EventLog.WriteE ntry(sSource, argument);
myProcess.Start Info.UseShellEx ecute = false;
myProcess.Start Info.RedirectSt andardOutput = true;
myProcess.Start Info.RedirectSt andardInput = true;
myProcess.Start Info.RedirectSt andardError = true;

myProcess.Start Info.CreateNoWi ndow = true;
myProcess.Start ();
EventLog.WriteE ntry(sSource,
myProcess.Stand ardOutput.ReadT oEnd());

myProcess.Stand ardInput.WriteL ine("y");
EventLog.WriteE ntry(sSource,
myProcess.Stand ardOutput.ReadT oEnd());
EventLog.WriteE ntry(sSource,
myProcess.Stand ardError.ReadTo End());

myProcess.WaitF orExit();

EventLog.WriteE ntry(sSource,"C hanged the Access Control
list");

service never seemed to have started successfully.
Thanks for all the help and valuable insights you have given me.