C# Windows Service -- How to Configure Security

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • Pegasus40218
    New Member
    • Apr 2010
    • 4

    C# Windows Service -- How to Configure Security

    I have created a Windows service application in C# that utilizes a FileSystemWatch er object to monitor changes to files in a directory specified in a configuration file. This service is being hosted on a Win2K3 server. The folder to be monitored is specified using a UNC path to a named share on a different Win2K3 server. The service is configured to run using a domain account that was created specifically for this service to run under.

    So, you have the following:
    - MYSERVICE -- This is the service name.
    - SERVER1 -- This is the server where MYSERVICE is installed.
    - SERVER2 -- This is the server where the folder that MYSERVICE is supposed to monitor is located.
    - \\SERVER2\WATCH ME -- this is the share that has been created on SERVER2 that I'm trying to monitor.
    - SERVICE_ACCOUNT -- the domain account that the service is configured to run under.

    So, here's the problem: when the path to monitor is local to the hosting server (such as "C:\WatchMe "), the service starts and runs fine. But when I try to designate a UNC path in the config file (such as "\\Server2\Watc hMe"), the service throws an Argument Exception: "The directory name \\Server2\Watch Me is invalid."

    I have tried "escaping" the backslashes in the directory name (\\\\Server2\\W atchMe) but this results in the same error.

    I have had the network admin grant explicit permissions to SERVICE_ACCOUNT on \\SERVER2\WATCH ME; but, that hasn't worked either.

    Running on my local machine under my user credentials, the service works fine monitoring a network share that I have rights to; so I don't think it's a code problem. I think the problem is the security configuration for SERVICE_ACCOUNT . Unfortunately, I don't know what rights to tell our network admins to give that account. Does anybody know what rights are needed?
  • Pegasus40218
    New Member
    • Apr 2010
    • 4

    #2
    OK...I found out what the problem was. The network admin was granting permissions on the wrong server. Once I got him to set the permissions on the share on the correct server, everything worked great!

    In case anyone is wondering, the permissions granted to the SERVICE_ACCOUNT on the target share were:
    - Modify
    - Read & Execute
    - List Folder Contents
    - Read
    - Write

    This is probably NOT the minimum required by the FileSystemWatch er (meaning that our network admin should probably reduce the granted permissions -- but I'm not going to fight with him over it!).

    Comment

    Working...