Service running as Local system account Unable to map drive on ano

Service running as Local system account Unable to map drive on ano

Secure Home | Search | About

Microsoft Applications Security - Microsoft's general security discussions and announcements 

Bookmark this page:  YahooMyWeb Yahoo!  Google Google  Windows Live Favorites Windows Live  del.icio.us del.icio.us  digg digg  Add to Netscape Netscape
Subject Author Date
Service running as Local system account Unable to map drive on ano systematic_pete 12-23-2005
Posted by =?Utf-8?B?c3lzdGVtYXRpY19wZXRl on December 23, 2005, 8:10 am
If you were  Registered and logged in, you could reply and use other advanced thread options
Hi all
I have a problem. I am developing a service which need to run as Local
System Account, and which need to access a directory on a remote computer, in
order to both read and write files. Both computers are running Windows 2000
and are in the same domain.

As Local System Account do not have any network permissions as such, I have
tried some alternative approaches but none seem to work.

1). I have tried to share the directory on the remote machine as a so called
null session share
(http://support.microsoft.com/default.aspx?scid=kb;en-us;289655), as that in
theory should allow access to everyone and everything. But when I tried to
write a file I got the "System error 5 has occurred.Access is denied." error.

2) Next I have tried to grant the computer account on which the service is
running full access to the share as this article describes
(http://forumz.tomshardware.com/software/Folder-Sharing-Computer-Accounts-ftopict225518.html).
With the same result.

The way I tested both approaches this:

In both methods I use UNC format and IP numbers to address the remote share,
like this: 2.168.106.12\share\

1) Run some code in my service using the function
OpenStreamOnFile(MAPIAllocateBuffer, MAPIFreeBuffer, ulFlags, file_name,
szFilePrefix, out_stream) function, and also fopen(
"2.168.106.12\share\data.dat", "w+" ). Both methods fail though.

2) started a CMD prompt with Local Systems Account credentials (using the
method described here:
http://www.windowsitpro.com/Article/ArticleID/47673/47673.html and the
psexc.exe tool from sysinternals - running psexec.exe -s cmd.exe). Then tried
to both copy a file manually using the copy command and to map a drive letter
using "net use". But all I got was a "System error 5 has occurred.Access is
denied."

I would appreciate any help I can get. Small things to try or even whole new
approaches, as I am really running out of ideas here. Also if you need
further information regarding my setup, please let me know.

Thanks, and a merry Christmas to all

Kind regards/ Venlig hilsen

Peter Langhoff Feddersen
System Engineer, MCSD

Systematic Software Engineering A/S
Web: www.systematic.dk

Posted by Joe Richards [MVP] on December 23, 2005, 12:33 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Did you set the appropriate permissions on the file system too? Remote
permissions are a combination of the share and file permissions with the most
restrictive being in control. I.E. Set the files/folders with everyone write.

--
Joe Richards Microsoft MVP Windows Server Directory Services
www.joeware.net


systematic_peter wrote:
> Hi all
> I have a problem. I am developing a service which need to run as Local
> System Account, and which need to access a directory on a remote computer, in
> order to both read and write files. Both computers are running Windows 2000
> and are in the same domain.
>
> As Local System Account do not have any network permissions as such, I have
> tried some alternative approaches but none seem to work.
>
> 1). I have tried to share the directory on the remote machine as a so called
> null session share
> (http://support.microsoft.com/default.aspx?scid=kb;en-us;289655), as that in
> theory should allow access to everyone and everything. But when I tried to
> write a file I got the "System error 5 has occurred.Access is denied." error.
>
> 2) Next I have tried to grant the computer account on which the service is
> running full access to the share as this article describes
>
(http://forumz.tomshardware.com/software/Folder-Sharing-Computer-Accounts-ftopict225518.html).
With the same result.

>
> The way I tested both approaches this:
>
> In both methods I use UNC format and IP numbers to address the remote share,
> like this: 2.168.106.12\share\
>
> 1) Run some code in my service using the function
> OpenStreamOnFile(MAPIAllocateBuffer, MAPIFreeBuffer, ulFlags, file_name,
> szFilePrefix, out_stream) function, and also fopen(
> "2.168.106.12\share\data.dat", "w+" ). Both methods fail though.
>
> 2) started a CMD prompt with Local Systems Account credentials (using the
> method described here:
> http://www.windowsitpro.com/Article/ArticleID/47673/47673.html and the
> psexc.exe tool from sysinternals - running psexec.exe -s cmd.exe). Then tried
> to both copy a file manually using the copy command and to map a drive letter
> using "net use". But all I got was a "System error 5 has occurred.Access is
> denied."
>
> I would appreciate any help I can get. Small things to try or even whole new
> approaches, as I am really running out of ideas here. Also if you need
> further information regarding my setup, please let me know.
>
> Thanks, and a merry Christmas to all
>
> Kind regards/ Venlig hilsen
>
> Peter Langhoff Feddersen
> System Engineer, MCSD
>
> Systematic Software Engineering A/S
> Web: www.systematic.dk

Posted by Phillip Windell on December 27, 2005, 11:08 am
If you were  Registered and logged in, you could reply and use other advanced thread options
You can't use the Local System Account. You will have to use a different
Account even if you have to create one for the purpose.

One other "maybe" would be the design the Application to be able to
"present" credentials to make the connection. The "Scheduled Tasks" in
Windows works this way in that the service runs under the Local System
Account, yet within the config of the "Task" you can give it credentials to
use when the task is "executed".

--
Phillip Windell [MCP, MVP, CCNA]
www.wandtv.com
-----------------------------------------------------
Understanding the ISA 2004 Access Rule Processing
http://www.isaserver.org/articles/ISA2004_AccessRules.html

Microsoft Internet Security & Acceleration Server: Guidance
http://www.microsoft.com/isaserver/techinfo/Guidance/2004.asp
http://www.microsoft.com/isaserver/techinfo/Guidance/2000.asp

Microsoft Internet Security & Acceleration Server: Partners
http://www.microsoft.com/isaserver/partners/default.asp

Deployment Guidelines for ISA Server 2004 Enterprise Edition
http://www.microsoft.com/technet/prodtechnol/isa/2004/deploy/dgisaserver.mspx
-----------------------------------------------------


> Hi all
> I have a problem. I am developing a service which need to run as Local
> System Account, and which need to access a directory on a remote computer,
in
> order to both read and write files. Both computers are running Windows
2000
> and are in the same domain.
>
> As Local System Account do not have any network permissions as such, I
have
> tried some alternative approaches but none seem to work.
>
> 1). I have tried to share the directory on the remote machine as a so
called
> null session share
> (http://support.microsoft.com/default.aspx?scid=kb;en-us;289655), as that
in
> theory should allow access to everyone and everything. But when I tried to
> write a file I got the "System error 5 has occurred.Access is denied."
error.
>
> 2) Next I have tried to grant the computer account on which the service is
> running full access to the share as this article describes
>
(http://forumz.tomshardware.com/software/Folder-Sharing-Computer-Accounts-ft
opict225518.html). With the same result.
>
> The way I tested both approaches this:
>
> In both methods I use UNC format and IP numbers to address the remote
share,
> like this: 2.168.106.12\share\
>
> 1) Run some code in my service using the function
> OpenStreamOnFile(MAPIAllocateBuffer, MAPIFreeBuffer, ulFlags, file_name,
> szFilePrefix, out_stream) function, and also fopen(
> "2.168.106.12\share\data.dat", "w+" ). Both methods fail though.
>
> 2) started a CMD prompt with Local Systems Account credentials (using the
> method described here:
> http://www.windowsitpro.com/Article/ArticleID/47673/47673.html and the
> psexc.exe tool from sysinternals - running psexec.exe -s cmd.exe). Then
tried
> to both copy a file manually using the copy command and to map a drive
letter
> using "net use". But all I got was a "System error 5 has occurred.Access
is
> denied."
>
> I would appreciate any help I can get. Small things to try or even whole
new
> approaches, as I am really running out of ideas here. Also if you need
> further information regarding my setup, please let me know.
>
> Thanks, and a merry Christmas to all
>
> Kind regards/ Venlig hilsen
>
> Peter Langhoff Feddersen
> System Engineer, MCSD
>
> Systematic Software Engineering A/S
> Web: www.systematic.dk



Similar ThreadsPosted
TCP/IP communication blocked when running a service as SYSTEM on W November 21, 2006, 3:50 pm
Local System Account & Network Access June 29, 2006, 9:08 am
Local system and user account - registry October 5, 2006, 6:27 am
Running MSI from a NT service problem September 17, 2008, 9:49 am
Running WWW Service in IIS 5.0 Isolation Mode... January 9, 2006, 8:04 pm
Automatic update service unable to connect October 16, 2008, 6:23 am
Renamed Local Administrator Account Name Reverts to Old Account Name November 30, 2005, 4:39 am
System service and UAC November 19, 2009, 8:40 am
How to make my portable drive accessible to my account only on two Windows XP SP2? June 20, 2005, 4:59 am
How Can I Add Local and Network Drive Letters to MSIE Trusted Sites Security Zone? October 15, 2007, 12:40 am

The site map in XML format XML site map

Contact Us | Privacy Policy