Installing a windows service as another user than Network Service - c#

I am using a self-installing variant to install my windows service. That means I run the exe that makes up the service, and when run it installs itself using the following line of code:
ManagedInstallerClass.InstallHelper(new[] { Assembly.GetExecutingAssembly().Location });
This works fine, and the service gets added to the list of services. My only problem is that this service gets added with Log On As equal to Network Service. I am doing certain operations from this service that require it to log on as Local System.
How can I make it install itself to run as Local System instead of Network Service?

I think you are using ServiceProcessInstaller. If so, you can set ServiceAccount.LocalSystem to its Account property

Related

Windows services does not run my class method

I have a windows service application which would scan the wifi list and save to file. then i will read the file and write to mysql database and close the file. my wifi scanning and db methods in another class within same windows service project which i invoke in service class. I am able to run and install the windows service but i think those methods are not called. I have even tried them in the service class but they still didn't call up in OnStart method. When i run it section mode and debug from visual studio it works fine but when i install it in installutil it only starts the service nothing happens though the service still runs in the background. I've created windows form version of this and that works fine.
I think it's more likely that the class method is called but writing the output file fails. The account that is used to run the service likely has no rights to create and/or write the output file. Check the folder that it should be written to and see if the account that runs your service has proper access rights. You can also use Process Monitor to verify this (set a filter on Path or Process Name).

Remote LogOn with WCF and C#

Is there any way to log on to a Windows machine using WCF and C#? I am creating a Test Harness and it will needed to remotely logon a Windows user.
So far we have not been able to do it successfully as once the user has been log off from the machine, self-hosted WCF is shut down.
your problem is that you are hosting the service as a console app. When the user logs off, the app stops.
Host your service in a windows service, which will enable it to start and run without a user being logged on.
MSDN on hosting in a windows service
as a tip, in the OnStart method add the following line:
Debugger.Launch();
and a using statement:
using System.Diagnostics;
if you have problems with the service starting and immediately stopping. This should allow you to attach a debugger to the service as it is starting to debug the issue.
Using supplied credentials on the web end you could try logging in via WMI? but, it does depend what you intend to do to the remote machines - other option would be a client on the remote machines

How to start process from ASP.NET Web Service (and allow to it to do everything what it wants to do)?

There is a Web Service installed on Amazon Server. Exposed WebMethod should start an executable. But, it seems that process (executable) started by WebMethod has not permissions to finish its job. If a WebMethod is called locally (using IE on Amazon VM) I can trace some events into log file placed on the path: C:\\LogFiles. But, if it is called from remote machine, there is no even log files. Locally, on my machine all works fine.
The question: is there any way or settings in IIS7 to allow to my WebService to create process that can do everything I want to do? In web.config file I added a line:
<identity impersonate="true" userName="USERNAME" password="password"/>
(userName and password are, of course, written correctly in the file).
Also, I tried to use impersonization as it is explained here, but there is no result. My process can't do its job, it cannot even trace actions into log file. Locally, on my machine, everything works fine.
Any idea how to change settings or whatever into IIS7?
EDIT: In addition to the main question: my WebService is not able even to create log files on the path: C:\\LogFiles - although it is able if it started locally, but remotely there is no simple log file that contains some string. How to allow it to create simple text files?
If all else fails, you may start such a process separately and make it wait for a signal. You can supply a signal in many ways — via an IP socket, via a mailslot, via a named pipe. The web service will post requests to the command pipe (or queue), and the 'executor' process will pop commands, execute them, and wait for more commands.
You should avoid trying to start external processes from ASP.NET - if anything, because your application will then be running under the context of the ASP.NET account. (Yes, you could use impersonation to launch into another account, but, lets not go there)
Instead, install a Windows Service which can receive a signal* to launch the executable you wish.
This has the advantage that you can customise what account the service runs under, without putting passwords inside your code.
(*) Signalling could be achieved through a number of means:
WCF Service Call (using a WCF Service being hosted by the Windows service)
Monitoring for a filesystem change to a known directory.
If you were using Linux, I would have given you the smartest solution ever, setting SUID flag, which is not possible in Windows.
The problem with impersonation is that it works as soon as you have some control over the server machine, more than having appropriate credentials.
You mentioned Amazon VM: I'm pretty certain that they won't allow, for security reasons, to perfrom impersonation. [Add] Or, better, they won't allow anybody to write in C:\
Option 1
Switch to Mono/Linux, set SUID bit using chmod from console and rock!!
Option 2
If you can run the executable other way than ASP.NET (ie. you have a Remote Desktop, SSH*) as privileged account (note: privileged doesn't mean Administrator) then you can redesign your application to have ASP.NET invoke services from your daemon process using WCF, Web Services or Remoting. But, in this case, you have to redesign your executable to be a stand-alone server.
[Add] None of the solution fix if your hosting provider doesn't allow you to write in paths such as C:\, but only allows you to write under your home directory.
*It works on Windows too!!!! And I mean the server!!!

Start a process as a specific user, from a WCF managed service running as LocalSystem

Is it possible to spawn a process on a remote server, from a WCF service hosted as Windows Managed Service, when the service is running as LocalSystem?
I need people to be able to execute things on remote servers under the context of their own accounts (basically like PSExec - which isn't an option).
I've made some half-hearted attempts to do this before, but when using process.start, cannot get the process to run as a specific user, if the Windows service hosting the WCF component is running as LocalSystem.
I know this can be acheived by other methods, but I specifically would like to know if the above is achievable - Windows service running as LocalSystem & hosting WCF service, then spawning a process as a specified user.
Thanks
Mick
You could use the Process.Start method which allows you to specify the user under which the process will run.

How do I give a Windows Service access to a MSMQ queue, with a setup project?

I have a windows service that needs to access a message queue (MSMQ).
The queue itself is created using a MessageQueueInstaller component that automatically generates the install code. I then deploy this using a standard setup project.
The service is installed in the same way, using the same setup project.
When I start the service it stops straight away, and I get the following exception in my code
Access to Message Queuing system is denied
I've tried both LocalService and NetworkService.
Do I need the installer to change the permissions required for the queue or do I need to change the permissions that the service has?
How should I modify the setup project to make this change?
You should change the permissions on the queue. Those users don't have access to the queue by default.
One of the reasons for this behaviour is caused because the MSMQ is installed in Networkgroup mode.
Try using an Account from the domain that has Admin rights in the computer. (that's the only thing that is working for me)
You could also Grand righst to MQ for this user. open computer manager and do it that way.

Categories