5

Given:

  • A VM running Windows 2008
  • I am logged on there using my domain account (SHUNRANET\markk)
  • I have added the "Create global objects" privilege to my domain account:
  • The VM is restarted (I know logout/logon is enough, but I had to restart)
  • I logon again using the same domain account. It seems still to have the privilege: enter image description here
  • I run some process and examine its Security properties using the Process Explorer. The account does not seem to have the privilege: enter image description here

This is not an idle curiousity. I have a real problem, that without this privilege the named pipe WCF binding works neither on Windows 2008 nor on Windows 7! Here is an interesting discussion on this matter - http://social.msdn.microsoft.com/forums/en-US/wcf/thread/b71cfd4d-3e7f-4d76-9561-1e6070414620.

Does anyone know how to make this work? Thanks.

EDIT

BTW, when I run the process elevated, everything is fine and the process explorer does display the privilege as expected:

enter image description here

But I do not want to run it elevated.

EDIT2

I equally welcome any solution. Be it configuration only or mixed with code.

EDIT3

I have posted the same question on MSDN forums and they have redirected me to this page - http://support.microsoft.com/default.aspx?scid=kb;EN-US;132958. I am yet to determine the relevance of it, but it looks promising.

Notice also that it is a completely coding solution that they propose, so whoever moved this post to the ServerFault - please reinstate it back in the StackOverflow.

11
  • Please explain why the question should be closed. The solution can be programmatic, which fits perfectly with this site.
    – mark
    May 18, 2011 at 8:30
  • I am sorry. I didn't get the impression the solution should be programmatic. I only saw the screenshots and thought it's a server configuration issue. But for someone who is into Windows security, it's probably obvious you ask about a programmatic solution, isn't it? May 18, 2011 at 8:32
  • @Ladislav - then by all means mark it as the answer :-).
    – mark
    May 18, 2011 at 8:47
  • @Grzegorz - I am looking for all solutions. Both configuration and programmatic. And because a programmatic solution is very likely this question belongs here. Of course, configuration only solution is most welcome as well.
    – mark
    May 18, 2011 at 8:49
  • 1
    @mark "Yet it never runs elevated." this is not true. NETWORK SERVICE does run elevated. that's the point of that account: it lets you run services on the local machine that require elevated rights and be a network server.
    – longneck
    Sep 14, 2012 at 18:31

2 Answers 2

1

If your NamedPipe WCF Service needs to be hosted in the Global objects to communicate between sessions I'd build it as a separate Windows Service and let the your other applications communicate with each other through the new Windows Service that will be hosting your NamedPipe WCF Service.

0

It because of a feature called UAC. Why don't you just turn it off? Then you won't need to run these tasks elevated, your account will just have this security permissions when you run the program normally.

See here for an article I found about UAC and problems it can have with certain programs. It is specifically ansering a problem about Explorer but the principle still applies and it explains how UAC works and possible work arounds. http://think-like-a-computer.com/2011/05/11/uac-access-denied-on-folders-for-administrators-windows-2008/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.