Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a service which needs to run as local system in order to work properly. If I run it as a domain user or even local admin it doesn't work correctly. However I need network access to resources and this only happens when I run it as a domain user. I tried granting access to the network resources to machinename$ to no avail. Is it possible to grant the same privileges as local system to a domain user? If yes how?

EDIT

To be more precise I am able to run the service as a regular user. However the program depending on the service is not able to load all needed processes whereas when as local system I can. However, as local system the program does not have access to shares on the network.

share|improve this question
    
What is krxed ? –  Mathias R. Jessen Apr 7 '13 at 18:27
    
typo... I fixed it now –  idipous Apr 7 '13 at 22:13
    
lusrmgr.msc? ... –  Jacob Apr 7 '13 at 23:01
    
Is this a common application or a custom application developers made for you? There could be a particular setting in group policy that is preventing it from working that we could know immediately based on what the service is you're having trouble with. –  Snowburnt Apr 10 '13 at 12:58
    
To be exact it is the Syntellect server trying to load nuance 8.5. –  idipous Apr 10 '13 at 13:02
add comment

7 Answers

The correct question would be: why exactly does your service needs to be run as system ?

Basically, unless you either build some kind of RPC proxy or change the program to be able to impersonate a domain user, you simply can't grant access to domain resources to the system account.

So, please try the following: download and run process monitor (procmon), set it up to register the activity of all processes involved and run them as local user. After this, check the log for any access denied (error code 5) result and come back with a result. At that point, we can start thinking about how to fix it through ACL changes or work around it.

share|improve this answer
    
I will try this and let you know. Thanks. –  idipous Apr 10 '13 at 8:59
    
I installed procmon but I couldn't find any access denied results. –  idipous Apr 10 '13 at 12:48
    
Then could you be more specific about what exactly is not working (including error messages, etc.) when you're running your service as a domain user ? –  Stephane Apr 10 '13 at 14:47
    
I do not get any error messages. The problem is that the syntellect server is not loading nuance 8 when the envox server's service is started as any user other than local system. –  idipous Apr 11 '13 at 6:19
    
Does that service need access to a database ? Is that where your problem lies ? Do you have anything in the logs ? –  Stephane Apr 11 '13 at 7:43
show 1 more comment

You have configured 'log on as service' and then add them to the group that they need? I use this all the time for services on servers.

http://technet.microsoft.com/en-us/library/cc739424(v=ws.10).aspx

share|improve this answer
    
Welcome to Server Fault! Generally we like answers on the site to be able to stand on their own - Links are great, but if that link ever breaks the answer should have enough information to still be helpful. Please consider editing your answer to include more detail. See the FAQ for more info. –  slm Apr 8 '13 at 4:49
    
I am using the domain administrator account and I have set this setting but to no avail. –  idipous Apr 9 '13 at 13:28
add comment

I would try to logon as domain user and run the service as local system. Otherwise you can try to logon as a local user and grant him access to your network resources.

share|improve this answer
    
I have tried logging in as domain user and run the service as local system and it works. the problem is that local system does not have access to the network infrastructure. I will try the second part of your suggestion. –  idipous Apr 10 '13 at 7:28
add comment

I would grant the act as part of the operating system and Log on as a service rights to that domain user.

To do that, open the MMC and add the local computer/group policy snap-in, expand local computer policy, computer configuration, Windows Settings, Security Settings, Local Policy, User Rights Assignment and edit the setting for Act as part of the operating system and add your domain user to the list of accounts with this right. Repeat this for Log on as a Service which should be in the same list of user rights.

The first privilege, at least, is a dangerous privilege to be assigning, so I wouldn't do this lightly, but I think it will work.

share|improve this answer
    
I had tried this approach but no luck. –  idipous Apr 10 '13 at 12:48
    
@idipous I could see where you'd tried log on as a service in a response to an earlier answer but you never mentioned trying act as part of of the operating system as well. I'm surprised it failed as act as part of the operating system should certainly allow your process to access anything that local system can access. It might be helpful if your question included the things you had already tried. It would save time for people trying to help you and it would improve the quality of the answers you are getting. –  RobM Apr 10 '13 at 14:06
add comment

Speak to however has provided the service to you. As Stephanie has already pointed out, the service probably shouldn't need to be run as local system. You don't detail what the service is, or what it does, but this is likely to be your underlying problem. Fixing this is the correct thing to do, weakening security to make it work, is the worst thing you can do, and for the love of kittens, please don't run it with domain administrator privileges, (which I see you've already tried from your comments), What if the service is easily exploitable? You've might have just granted someone full access to your entire AD, which will probably turn out to be a bad day for you.

I assume the network resources is a file share? As long as the computer is a domain member, granting the computer account access to the resource should work fine if the service runs as local system, but you need to ensure that both the share and NTFS permissions are considered. You can test that this works by launching a command prompt running as local system with psexec, then try mapping a drive using net use. If you've got it set up right, it should work.

share|improve this answer
add comment

I tried granting access to the network resources to machinename$ to no avail.

Add the compuer account to the "Domain Users" group. You can do it from the Active Directory console, just make sure to search for computers when you add groups members as by default computers do not show up in the search results when adding group members.

That way the LOCAL SYSTEM user on the computer will have access to domain resources.

share|improve this answer
    
This won't always work. Depends on how your Active Directory is setup. Upto w2k3 this will work out of the box unless the admin has locked things down. As of W2k8 this won't wok unless the admin has lowered security to make it possible. (I don't have details on how exactly. I talked to my Enterprise admin last year about a similar issue and he told me it was possible but refused to give me some pointers. Apparently it effectively breaks Windows security and opens the door for trojans/rootkits.) –  Tonny Apr 12 '13 at 23:09
    
On my 2008R2 test machine it seems to work straight out of the box. As for breaking windows security, from my experience once a well-designed malware gets local system privileges, it quickly gains domain access as the first domain user logs in (either through keylogging or by reusing the user's kerberos token in memory). –  JOAT Apr 13 '13 at 21:28
    
You'right about Windows in general, but at least we can make a token effort to make if more difficult... About working on W2k8: After some checking with others I found that W2K8R2 if done as a fresh install is also not entirely locked down here. Most admins I know do some default further locking down stuff (often as domain policy). I wouldn't know. I mainly do datacenter-builds, networks and server-integration. Windows security I leave to the specialists. –  Tonny Apr 14 '13 at 10:53
add comment

Get process monitor (http://technet.microsoft.com/en-us/sysinternals/bb795533.aspx). Keep it running while the service performs incorrectly. See if any red flags are raised or there are any file or registry permission errors. This should give you an idea if there's some local process that's not able to run.

I would also contact support for the software, they may be able to walk you through a solution...Though I can believe it if they said: All we require is local system, why would you want more?

That said, if you've tried using local admin, with the user set to be able to log on as service and act as part of operating system, that should eliminate any local issues. Have you tried setting it to a domain admin, just to see? If it's running as a user it might not require the computer account to have access, but it would definitely require the user it's running as to have privileges. Try adding the user to the other boxes it needs network access to with the same local security policy setting set.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.