3

I have a service which needs to run as local system in order to work properly. If I run it as a domain user or even local admin it doesn't work correctly. However I need network access to resources and this only happens when I run it as a domain user. I tried granting access to the network resources to machinename$ to no avail. Is it possible to grant the same privileges as local system to a domain user? If yes how?

EDIT

To be more precise I am able to run the service as a regular user. However the program depending on the service is not able to load all needed processes whereas when as local system I can. However, as local system the program does not have access to shares on the network.

5
  • What is krxed ? Apr 7, 2013 at 18:27
  • typo... I fixed it now
    – idipous
    Apr 7, 2013 at 22:13
  • lusrmgr.msc? ...
    – Jacob
    Apr 7, 2013 at 23:01
  • Is this a common application or a custom application developers made for you? There could be a particular setting in group policy that is preventing it from working that we could know immediately based on what the service is you're having trouble with.
    – Snowburnt
    Apr 10, 2013 at 12:58
  • To be exact it is the Syntellect server trying to load nuance 8.5.
    – idipous
    Apr 10, 2013 at 13:02

7 Answers 7

2
+25

The correct question would be: why exactly does your service needs to be run as system ?

Basically, unless you either build some kind of RPC proxy or change the program to be able to impersonate a domain user, you simply can't grant access to domain resources to the system account.

So, please try the following: download and run process monitor (procmon), set it up to register the activity of all processes involved and run them as local user. After this, check the log for any access denied (error code 5) result and come back with a result. At that point, we can start thinking about how to fix it through ACL changes or work around it.

5
  • I installed procmon but I couldn't find any access denied results.
    – idipous
    Apr 10, 2013 at 12:48
  • Then could you be more specific about what exactly is not working (including error messages, etc.) when you're running your service as a domain user ?
    – Stephane
    Apr 10, 2013 at 14:47
  • I do not get any error messages. The problem is that the syntellect server is not loading nuance 8 when the envox server's service is started as any user other than local system.
    – idipous
    Apr 11, 2013 at 6:19
  • Does that service need access to a database ? Is that where your problem lies ? Do you have anything in the logs ?
    – Stephane
    Apr 11, 2013 at 7:43
  • Have you contacted vendor support to see if this is even supported?
    – Snowburnt
    Apr 16, 2013 at 14:04
0

You have configured 'log on as service' and then add them to the group that they need? I use this all the time for services on servers.

http://technet.microsoft.com/en-us/library/cc739424(v=ws.10).aspx

2
  • Welcome to Server Fault! Generally we like answers on the site to be able to stand on their own - Links are great, but if that link ever breaks the answer should have enough information to still be helpful. Please consider editing your answer to include more detail. See the FAQ for more info.
    – slm
    Apr 8, 2013 at 4:49
  • I am using the domain administrator account and I have set this setting but to no avail.
    – idipous
    Apr 9, 2013 at 13:28
0

I would try to logon as domain user and run the service as local system. Otherwise you can try to logon as a local user and grant him access to your network resources.

1
  • I have tried logging in as domain user and run the service as local system and it works. the problem is that local system does not have access to the network infrastructure. I will try the second part of your suggestion.
    – idipous
    Apr 10, 2013 at 7:28
0

I would grant the act as part of the operating system and Log on as a service rights to that domain user.

To do that, open the MMC and add the local computer/group policy snap-in, expand local computer policy, computer configuration, Windows Settings, Security Settings, Local Policy, User Rights Assignment and edit the setting for Act as part of the operating system and add your domain user to the list of accounts with this right. Repeat this for Log on as a Service which should be in the same list of user rights.

The first privilege, at least, is a dangerous privilege to be assigning, so I wouldn't do this lightly, but I think it will work.

2
  • I had tried this approach but no luck.
    – idipous
    Apr 10, 2013 at 12:48
  • @idipous I could see where you'd tried log on as a service in a response to an earlier answer but you never mentioned trying act as part of of the operating system as well. I'm surprised it failed as act as part of the operating system should certainly allow your process to access anything that local system can access. It might be helpful if your question included the things you had already tried. It would save time for people trying to help you and it would improve the quality of the answers you are getting.
    – Rob Moir
    Apr 10, 2013 at 14:06
0

Speak to however has provided the service to you. As Stephanie has already pointed out, the service probably shouldn't need to be run as local system. You don't detail what the service is, or what it does, but this is likely to be your underlying problem. Fixing this is the correct thing to do, weakening security to make it work, is the worst thing you can do, and for the love of kittens, please don't run it with domain administrator privileges, (which I see you've already tried from your comments), What if the service is easily exploitable? You've might have just granted someone full access to your entire AD, which will probably turn out to be a bad day for you.

I assume the network resources is a file share? As long as the computer is a domain member, granting the computer account access to the resource should work fine if the service runs as local system, but you need to ensure that both the share and NTFS permissions are considered. You can test that this works by launching a command prompt running as local system with psexec, then try mapping a drive using net use. If you've got it set up right, it should work.

0

I tried granting access to the network resources to machinename$ to no avail.

Add the compuer account to the "Domain Users" group. You can do it from the Active Directory console, just make sure to search for computers when you add groups members as by default computers do not show up in the search results when adding group members.

That way the LOCAL SYSTEM user on the computer will have access to domain resources.

3
  • This won't always work. Depends on how your Active Directory is setup. Upto w2k3 this will work out of the box unless the admin has locked things down. As of W2k8 this won't wok unless the admin has lowered security to make it possible. (I don't have details on how exactly. I talked to my Enterprise admin last year about a similar issue and he told me it was possible but refused to give me some pointers. Apparently it effectively breaks Windows security and opens the door for trojans/rootkits.)
    – Tonny
    Apr 12, 2013 at 23:09
  • On my 2008R2 test machine it seems to work straight out of the box. As for breaking windows security, from my experience once a well-designed malware gets local system privileges, it quickly gains domain access as the first domain user logs in (either through keylogging or by reusing the user's kerberos token in memory).
    – JOAT
    Apr 13, 2013 at 21:28
  • You'right about Windows in general, but at least we can make a token effort to make if more difficult... About working on W2k8: After some checking with others I found that W2K8R2 if done as a fresh install is also not entirely locked down here. Most admins I know do some default further locking down stuff (often as domain policy). I wouldn't know. I mainly do datacenter-builds, networks and server-integration. Windows security I leave to the specialists.
    – Tonny
    Apr 14, 2013 at 10:53
0

Get process monitor (http://technet.microsoft.com/en-us/sysinternals/bb795533.aspx). Keep it running while the service performs incorrectly. See if any red flags are raised or there are any file or registry permission errors. This should give you an idea if there's some local process that's not able to run.

I would also contact support for the software, they may be able to walk you through a solution...Though I can believe it if they said: All we require is local system, why would you want more?

That said, if you've tried using local admin, with the user set to be able to log on as service and act as part of operating system, that should eliminate any local issues. Have you tried setting it to a domain admin, just to see? If it's running as a user it might not require the computer account to have access, but it would definitely require the user it's running as to have privileges. Try adding the user to the other boxes it needs network access to with the same local security policy setting set.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .