We Keep Coding

.Net - Remote BizTalk server monitoring using WMI when the SQL server is located on another VM

I have created a windows service to monitor receive location and send port events i.e. start/stop/enabled/disabled/enlisted/unenlisted for a local BizTalk server machine using a WMI ManagementScope class scope:
string strScope = #"\\.\root\MicrosoftBizTalkServer";
But when I try pointing at a remote machine/server to capture events using:
string strScope = string.Format(#"\\{0}\root\MicrosoftBizTalkServer", node.Address);
I receive an odd WMI error. The typical remote machine I am trying to point towards is a similar windows server with one small distinction that its BizTalk server is pointing to a SQL server located on yet another server within the network.
After a lot of googling and searching, I came across information pointing at a possible cause of failure being the classic "Double-hop" issue which occurs when we try to access remote BizTalk server when its SQL server is on another machine.
Within visual studio I was not getting enough information on the error that I tried a windows built-in tool "wbemtest.exe" to troubleshoot what was going on only to uncover a long error message such as this:
BizTalk Server cannot access SQL server. This could be due to one of the following reasons:
\n1. Access permissions have been denied to the current user. Either log on as a user that has been granted permissions to SQL and try again, or grant the current user permission to access SQL Server.
\n2. The SQL Server does not exist or an invalid database name has been specified. Check the name entered for the SQL Server and database to make sure they are correct as provided during SQL Server installation.
\n3. The SQL Server exists, but is not currently running. Use the Windows Service Control Manager or SQL Enterprise Manager to start SQL Server, and try again.
\n4. A SQL database file with the same name as the specified database already exists in the Microsoft SQL Server data folder.
\n
\nInternal error from OLEDB provider: \"Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'.\""
I have tried playing with Firewall and DCOM setting under Administrative Services -> Component Services but no setting is working for me to pass on my user's credentials via "impersonation" and retrieve back receive location / send ports information.
Please share a workaround/solution/configuration settings that actually addresses this issue.

After a lot of research and thorough study, the solution was achieved via enabling / configuring Kerberos authentication for the non-domain admin. service account user and machines involved in communication i.e. client (machine sending WMI based request), Biztalk node (machine responding to the WMI based request) and SQL Server node (machine hosting / running SQL Server database engine service and most importantly Biztalk's databases which include messagebox, tracking, management and SSO).
This was all done under a single domain and delegation was setup for both the Biztalk node and SQL Server node along with the service account used.
DCOM permissions were granted to the service account for WMI and DTC(Distributed Transaction Coordinator) permissions were setup.
Appropriate SPNs were generated and appropriate SQL Server permissions were granted to the service account initiating WMI request in delegation mode.
Verified that Kerberos was enabled for the particular service account using the following SQL query:
select session_id,net_transport,client_net_address,auth_scheme from sys.dm_exec_connections

This is a double hop issue only, the problem you are facing is because you are trying to run a service and access remote server BizTalk server, which is then trying to logon to a remote SQL server. Your credential only reaches to BizTalk server but BizTalk server does not pass your credentials to another server.
Refer to this link for solution
Similar Issue

Windows service install doesn't have correct privileges

I have a service that I have created for Windows. The service works fine. The problem I am having is a permission issue. My service accesses a .mdf SQL Server database file that is created when the service is installed (using Installshield VS 2012).
The service itself is running as user. When I install I input my credentials and I can successfully start the service. The service starts fine. However, when I get to the part in my code where I have to open the .mdf I get an error because the database log file does not exists and the service does not have permissions to create it.
The only way I can fix it is by adding my username or authenticated users for example to the security section of my program files folder. This allows the SQL Server .log file to be created and my service continues running.
What is the best solution to getting around this? Basically I want to be able to run the service and local system and it have the privileges to install and create the .mdf.
Thank you for the help.

You should create the database log file during the installation. You can run custom code during the installation to do that (the code may be similar to what triggers creation of the log file in your regular code). That will use the user with elevated permissions so it will work well and is correct from the security point of view (all administrative tasks should be done during the installation in this case).
It's better not to add permissions for a normal user to SQL Server data folder as that will lower security.

Access to a Sharepoint Remote Folder from C#

I have developed an ASP.NET MVC 3 which must access to a SharePoint Remote Folder.
To do that, during the development, before to run the Visual Studio Development Server, I try to access to the remote folder. Then, I must introduce the credentials of the user who has permission to see the remote resource. After this, using the following code:
string path = #"\\tests.sharepoint.es\folder1";
DirectoryInfo di = new DirectoryInfo(path);
DirectoryInfo[] dis = di.GetDirectories();
The access to the folder is successful. However, this fails when I executed my web application from the IIS, getting the next error:
Access to the path '\tests.sharepoint.es\folder1\' is denied.
Even if I set for the Application Pool the same user that runs the Visual Studio Development Server, it continues failing.
I have identified that the users who runs the World Wide Web Publish Service (W3SVC) is SYSTEM (an account who obviously doesn't have permission to access to the folder) but I can't change this and I am not sure if this causes the problem.
Also, I have read some posts about using SPSecurity.RunWithElevatedPrivileges but I can't use it because my IIS server doesn't have Sharepoint installed (it is in another machine) and therefore, I can't use Microsoft.Sharepoint.dll as far as I know.
UPDATE: When I try to access to the resource using my windows explorer, I have read that OS uses WebDav instead of NetBios. Can IIS use this protocol to access to the resource?

If you really need to access remote resource with Windows permissions from Windows web server (or any other server that impersonates remote client) than you must run such code under account directly signed in on the server box. This is caused by "NTLM one hop" policy - user's credentials can be used only on machine user directly signed in to or machine user directly communicates to (and not on third one that this second machine tries to connect to).
Safest approach is to run process under account that have access to remote resource and run code in that process. You can run IIS process under such account, but you may need to revert impersonation back to process if running code during requests.
You can also directly impersonate particular user but you'll need to have plain text login information. This is most likely against security policy for most companies.
Note: you very well may end up building anonymization proxy - be very careful to understand what it means to access remote resource under account different from actual user's account.

Fortunately, I have found how to resolve the access problem.
I have used the solution described in this post.
My code seems like this:
PinvokeWindowsNetworking.connectToRemote(#"\\tests.sharepoint.es\folder1", "domain\user", "password");
//manage files and folders of my remote resource
//...
PinvokeWindowsNetworking.disconnectRemote(#"\\tests.sharepoint.es\folder1");

Running SSIS packages remotely - what account do they run under?

I am currently building an application in .NET 4.0 that will use SSIS 2008R2 packages to do its job. The packages are located on a separate SQL Server. The SQL server has an account proxy that has all the permissions needed for the packages to execute (call Reporting services, access disk, etc).
My question is: what is the best way to run those packages from C#?
I read about using SQL Agent to run the packages through jobs but my concern is this - what account will the job and packages use? Will it be the account under which the application is running or I can use the proxy account that I have in SQL Server? How can I configure this?
Thanks in advance!

You can configure the user that each job step is run under in SQL Server agent. It is common to use the proxy user here.
An easy way to start the jobs in case you need SQL Server database access anyway is via calling the SQL Server Agent system stored procedures. But note that starting a job via dbo.sp_start_job is asynchronous: It just starts the job and then returns. You will have to poll other methods to check the job status or outcome.
And the database user that you are using to connect to the database (or your local user in case you use integrated login to SQL Server) must have the permission to call the stored procedure.

How to access the database Remotely through IIS?

I have used the ASP.net with C#. I want to access the SQL Server database through web server. When executing my application from development area it's working but after deploy the application to the IIS server it shows the following exception:
CREATE DATABASE permission denied in database 'master'. An attempt to
attach an auto-named database for file D:\newtest\newtest.mdf failed.
A database with the same name exists, or specified file cannot be
opened, or it is located on UNC share.
I have used the following connection string to attached with database
Data Source = .\\SQLEXPRESS;AttachDbFileName=databasepath; Integrated Security=true
How do I access the SQL Server database Remotely through IIS?

Although the answer by Sanjay is correct, it doesn't really explain why you're getting the permission denied.
Code running in ASP.NET / IIS runs as a specific user, as defied in the worker process' config. For IIS 6 [Server 2003] (and below, I think) the default was NETWORK SERVICE for IIS 7+ [Server 2008], the default behavior is to run as a special application pool user IISAPPPOOL\yourAppPoolName.
If you grant the requisite permissions on your database for the correct user account(s) -- you should be able to get around the error and still use integrated security.
As an aside, it is generally a good idea to give the most restrictive (yet still operable) set of permissions on your database. CREATE DATABASE requires a pretty high permission level (I don't remember what off the top of my head.) If you grant that to your IIS application, you run a significant risk of allowing a less than honorable user taking control of your database system and wreaking havoc on it.

Hey Create Credential with SQL server and update your config file
connectionString="Data Source=Abcl\SQLEXPRESS;Initial Catalog=master;User ID=sa;Password=pwd12" providerName="System.Data.SqlClient"
if your are using db file like mdf
Pls use like this
connectionString="AttachDbFilename='C:\Documents and Settings\nmartin\My Documents\PS_Upload\TimeTrack\src\TimeTracker\TimeTrack\App_Data\ASPNETDB.MDF';Integrated Security=True; User Instance=True"

They key is that you've used Integrated Security=True in your conneciton string.
When you run your project in your development environment, the web application usually runs as your local user account. Furthermore, your account is usually a privileged user (admin) on the local SQL instance.
On your deployment server, IIS usually runs as a local machine account (or an account provisioned for your AppPool). That account usually doesn't have any special privileges on the SQL server instace.
As debracey points out, you normally don't want to have your app's SQL privileges high enough to cause any harm (even if it's an honest mistake on your part). One common pattern to avoid tihs is to have two separate SQL accounts for your app:
A high-priviledged account for creating and modifying your database schmea (e.g. db_owner role)
A limited-privilege account for accessing your database while your app runs (e.g. db_datareader and/or db_datawriter role)