Service mode under a user account

[megamojo]

Why is there not a link to this article, or the instructions themselves, in the sage manual and/or in a sticky?

I have been a happy sage user for a few years now, and have run it as a service almost since day one. I was always frustrated that running the service under any account besides the special localsystem account didn't work. I can't count how many times I've seen people mention running the service under a real user account, but no one ever mentions that you can't do this by default. I initially only imported media library files from my linux samba server, which didn't care about the null logon that the localsystem account has. Then I wanted to access files shared on a windows box. It didn't work, as you already know. In all of my searching I never came across that I need to enable my user account to run services, but I did come up with a much, much more complicated solution.

When last night I finally came across how to enable services to run under a user account I felt dumb, thinking that this is common knowledge. Seeing as I'm an IT professional I thought it was weird that I had never heard of this "common knowledge, so I asked 2 of my peers and my boss, the Director of IT here. They had not heard of enabling user accounts to run services either, so in my opinion this is not exactly common knowledge.
/endofrant

Am I missing something here? Has this been previously posted elsewhere that's easy to find? Obscure buried threads don't count. I've already searched and the information is remarkably hard to stumble across as far as I can tell.

[AtariJeff]

I've always run SageTV as a service under my standard user login name. No fuss no muss. I never had to do anything special to the user profile. Running XP Pro SP2.

[gplasky]

Being in the IT business myself, running a service under a user account is a common practice. Installing an application like Symantec Backup Exec or a Citrix server requires access to other servers and files throughout the domain. We always define a user account with a password usually with a higher level of authority (sometimes administrator) to run that service. There are many applications that run as a service or run services that need that type of access in a large network.

Gerry

[megamojo]

I completely understand the reasons and applications for running a service under a user account, I just wasn't able to do it before due to lack of knowledge. The part that made me come out and rant was that there is no official documentation, either in the manual or a sticky, of how to enable this. Obviously some users, like atarijeff, get lucky and don't have to configure anything, but I don't think I'm alone in having trouble getting the service to log in under a user account.

[sainswor99]

First, I agree with you that instructions on how to change a service from localsystem to a user mode should be included in the documentation. Although many Sage users are adept power users of Windows (and other OS's), not every user is. If the manual suggests changing the service to run as a user account, it should give more detail on how to do it.

Second, though; I have a tough time accepting that an IT professional (particularly with the title of Director) doesn't understand Windows user accounts and how they affect applications and services. That's a pretty large knowledge gap, and has lots of implications for the security of your business. I'm trying very hard to not sound snarky, but I think you need to examine that knowledge gap and find some method of filling it.

Stu

[Opus4]

I'm a little confused... what is the difference between this and the instructions starting on p. 14 of the v6.3-B PDF manual, where it explains how to configure the SageTV service to log on as a user w/a password in order to access network paths?

And, if the difference is as obscure as the first post makes it sound, then it doesn't surprise me that it wasn't mentioned before.

- Andy

[megamojo]

Originally Posted by sainswor99

First, I agree with you that instructions on how to change a service from localsystem to a user mode should be included in the documentation. Although many Sage users are adept power users of Windows (and other OS's), not every user is. If the manual suggests changing the service to run as a user account, it should give more detail on how to do it.

Second, though; I have a tough time accepting that an IT professional (particularly with the title of Director) doesn't understand Windows user accounts and how they affect applications and services. That's a pretty large knowledge gap, and has lots of implications for the security of your business. I'm trying very hard to not sound snarky, but I think you need to examine that knowledge gap and find some method of filling it.

Stu

As for my knowledge gap, I'm just starting out and know I need to get some certs before moving on to bigger and better things. I have a B.A. in Biology, but realized around junior/senior year that I actually wanted a career in IT after doing some work-study in it and realizing I was a bigger geek than most CS majors. I feel like I know my way around system admistration pretty well, but it's knowledge gaps like these that show me that formal training has its merits. The other guys I asked are similar and the higher level techs weren't around. As for the Director, well, he hasn't needed to be in the nitty gritty details since the mid-90s, so he's definitely more of a director now than a "doer."

I'm glad you agree with me on the documentation though. For a long time I thought my system was just flukey and I was very glad to get to the bottom of it. I would like other users to not have to go through that same frustration.

Originally Posted by Opus4

I'm a little confused... what is the difference between this and the instructions starting on p. 14 of the v6.3-B PDF manual, where it explains how to configure the SageTV service to log on as a user w/a password in order to access network paths?

And, if the difference is as obscure as the first post makes it sound, then it doesn't surprise me that it wasn't mentioned before.

- Andy

The difference is that that part of the manual just tells you to click on the change user button and enter the username and password. On a windows box with default configuration, even using an admin account, this simply does not work. The service will not run under the user account and will tell you that the username or password is incorrect. If you try it with other services that would work well under a user account, such as dirmon2 for instance, the service will just fail to start, with no error message or explanation.

[gplasky]

If you have a user on that box with a password and that user is in the Administrator group it will work every time. And worse case, instead of using Sage's Sagetvservice.exe app you can go right to Manage Computer-Services and enable it there with a user that has a password and is in the administrator group.

Gerry

[Opus4]

Originally Posted by megamojo

The difference is that that part of the manual just tells you to click on the change user button and enter the username and password. On a windows box with default configuration, even using an admin account, this simply does not work. The service will not run under the user account and will tell you that the username or password is incorrect. If you try it with other services that would work well under a user account, such as dirmon2 for instance, the service will just fail to start, with no error message or explanation.

Yes, it does work. How did your user account get set not to allow services? I've never had to do anything on my system to allow the SageTV service to run, so I documented exactly what I and everyone else I've heard from had to do: configure the service to log in as a user w/a password. The instructions stopped there because I've never heard of having to do more.

Some people have expanded on that to uses services.msc in order to set additional service options, but that isn't going to be in the docs.

So, I don't see this as an issue with default accounts, unless the account is a limited one, in which case I don't believe SageTV will run properly in the first place; I think it needs more permissions than a limited account has -- there have been posts on the forum about not being able to use a limited user account, even in non-service mode.

And, please drop the rant (in your own words) about what you've brought up not being documented. It wasn't documented because it wasn't previously known to me. If there is additional information that should be included about using service mode, I'll be glad to add it to the manual. If the additional information helps other users in the future, then that's great. At this point, I just want to understand what it is that is happening in this topic.

- Andy

[megamojo]

edit: I for one, think it's funny how we're all posting at the same time.

Originally Posted by gplasky

If you have a user on that box with a password and that user is in the Administrator group it will work every time. And worse case, instead of using Sage's Sagetvservice.exe app you can go right to Manage Computer-Services and enable it there with a user that has a password and is in the administrator group.

Gerry

In my experience having a user on that box with a password that is in the Admin group still does not get you access to log on as a service. I just tried it again with a fresh test account to be sure. Using the services manager works great, but you'll notice when you do this it pops up a message saying the account has been granted the right to logon as a service. I'm not trying to be beligerent, I was just wondering if the proper configuration instructions exist somewhere official. It seems that they do not.

Originally Posted by Opus4

Yes, it does work. How did your user account get set not to allow services? I've never had to do anything on my system to allow the SageTV service to run, so I documented exactly what I and everyone else I've heard from had to do: configure the service to log in as a user w/a password. The instructions stopped there because I've never heard of having to do more.

Some people have expanded on that to uses services.msc in order to set additional service options, but that isn't going to be in the docs.

So, I don't see this as an issue with default accounts, unless the account is a limited one, in which case I don't believe SageTV will run properly in the first place; I think it needs more permissions than a limited account has -- there have been posts on the forum about not being able to use a limited user account, even in non-service mode.

And, please drop the rant (in your own words) about what you've brought up not being documented. It wasn't documented because it wasn't previously known to me. If there is additional information that should be included about using service mode, I'll be glad to add it to the manual. If the additional information helps other users in the future, then that's great. At this point, I just want to understand what it is that is happening in this topic.

- Andy

Well, I'll concede that it's definitely possible that my system is somehow unique. In the past I've initially configured the user account without a password. When I tried to run the service under a user account, I created a password at that point. Maybe You have to reboot after that to autmatically get the ability to log on as a service, or maybe the automatic part doesn't work right unless the account has a password right from the get go. I do know that over the years I've re-installed windows many times on whatever hardware happened to be running sage and I've never, until yesterday, been able to get the service to run under a user account. In the new test account I mentioned above, here is exactly what I did. I went to the user accounts in control panel and created a new account with administrator privileges. I then created a password for the account. I then checked the log on as a service user list under group policy, and that new account was not listed. I tried to run the dirmon2 service under that account using the dirmon gui, which is very similar to the sage service control gui with regards to accounts. The dirmon service would not start under that account. Then I went into the Windows services manager as gplasky suggested, told the dirmon service to use the new account, got a message that the account had been given the right to logon as a service, and it worked fine after that. I went back to the group policy editor just to check and the new account now appears in the list of accounts that are allowed to logon as a service.

Again, I'm not trying to start any fights and I'm certainly not trying to insult anyone at sage. I apologize if I came off this way. I just had a frustrating issue and I was surprised that it seemed to have very little if any documentation.

[sainswor99]

Originally Posted by Opus4

I'm a little confused... what is the difference between this and the instructions starting on p. 14 of the v6.3-B PDF manual, where it explains how to configure the SageTV service to log on as a user w/a password in order to access network paths?

And, if the difference is as obscure as the first post makes it sound, then it doesn't surprise me that it wasn't mentioned before.

- Andy

You know, when I searched the manual for it, I found the part on page 16, and thought that was it. Never occurred to me to skip back a couple of pages. I was still thinking in Windows terms; go to Service Account, find the Service, and change the account under which it runs.


Stu

[Narflex]

This happens automatically with the SageTVServiceControl application which is why its not documented. (if you tell it to use a certain account; it'll then grant service rights to that account) But if you set yours up a few years ago; it might not have had that feature back then. (I know some of the first versions of that didn't do it)

[Opus4]

Originally Posted by Narflex

This happens automatically with the SageTVServiceControl application which is why its not documented. (if you tell it to use a certain account; it'll then grant service rights to that account) But if you set yours up a few years ago; it might not have had that feature back then. (I know some of the first versions of that didn't do it)

Thanks -- now at least I know why it never came up in terms of documentation.

So...

Originally Posted by megamojo

In my experience having a user on that box with a password that is in the Admin group still does not get you access to log on as a service. I just tried it again with a fresh test account to be sure. Using the services manager works great, but you'll notice when you do this it pops up a message saying the account has been granted the right to logon as a service.

Based on the above post, did you initially try using SageTV's SageTVServiceControl.exe tool insted of the Windows service utilities, as documented in the manual? It looks like that tool should have handled the permissions unless you have a much older version of SageTV.

I would guess that if you are trying to use a recent version of SageTVServiceControl.exe and permission to run as a service is not being added, then you should report that to SageTV because if this is the case, perhaps something else needs to be done on your version of Windows.

I tried to run the dirmon2 service under that account using the dirmon gui, which is very similar to the sage service control gui with regards to accounts. The dirmon service would not start under that account. Then I went into the Windows services manager as gplasky suggested, told the dirmon service to use the new account, got a message that the account had been given the right to logon as a service, and it worked fine after that.

It looks like you should bring this up w/the dirmon creator.

- Andy

[megamojo]

Well, it seems like this is a non-issue then. I did initially set this up years ago with version 2, and I got frustrated back then that I couldn't get it to work under a user account. After that I guess it stuck in my head that it just wasn't going to work right. It wasn't a big deal since my linux box actually did allow access, and later on I used a pretty complicated workaround which I linked to in my first post. The other day for some reason I got the bug to finally set things up the "right way" and instead of just trying it first I made my life more complicated by researching the issue extensively instead of just trying it out and seeing if it would work. To complicate things, I didn't want to mess with my server in production (WAF is important you know!), so I did most testing with the dirmon service, which does not automatically grant service rights. I tried it with a fresh account and the sage service and it works just fine now. But at least I learned a little more about windows administration along the way! Thanks everyone for you input.

[Taddeusz]

Originally Posted by megamojo

In my experience having a user on that box with a password that is in the Admin group still does not get you access to log on as a service. I just tried it again with a fresh test account to be sure. Using the services manager works great, but you'll notice when you do this it pops up a message saying the account has been granted the right to logon as a service. I'm not trying to be beligerent, I was just wondering if the proper configuration instructions exist somewhere official. It seems that they do not.

Ok, this keeps bugging me in your posts and this may be what's got you confused. Users don't log on as a service. It's the other way around. A service will run as a particular user. In this case the user must be in the Administrators group on the local computer and have a password set (no blank passwords allowed).

edit: I suppose I'd have to check my own computer at home. If it sets the "log on as service" automatically I suppose I never noticed. :-P

[megamojo]

Yes you're right, but the actual wording of the group policy is "log on as a service." That's the only reason I was saying it that way.