Develop Reference

Access Denied when running Windows Service

I have created a Windows Service using ASP.Net Core 3.x and C#. I started with the new Windows Service template when I built the project. When I run it from my development environment or from a console window it runs fine. When I install it as a Windows Service and attempt to start the service I get an
"Error 5: Access is denied." error.
I tried numerous things which I will outline below to eliminate the error but nothing seemed to work so I downloaded the sample app provided by Microsoft, at sample
Same result...when I run the sample app from within Visual Studio it runs fine, when running as a service I get the Access Denied error.
I am running all of this on my local machine, which I am an admin on.
I originally tried to run it using the default Local System account; got the Access Denied error.
I changed the Log On As to my domain account, the same one I use to log into my local machine which is an admin on this machine; got the same Access Denied error.
My account has the privilege set to run as a service.
The Event Viewer just shows the one message which says "Access Denied", no other messages are created.
I believe the Access Denied error is occurring before the C# code is even executed. What makes me believe this is that I added one line to the very top of the Program.Main.... File.WriteAllText("C:\\temp\\ws.log", $"Test of Worker Service # {DateTime.Now}. Content Root Path: {AppContext.BaseDirectory}");. My account has full access to the temp folder. This file gets created when I run the app from Visual Studio but it does not get created when I run the app as a service.
I have read numerous web sites, include this one and this one. No luck, everything I tried from these sites still produce the Access Denied error.
I have run out of ideas and am hoping someone here can provide me the answer. Thanks!

I found the solution and believe me I feel really stupid!!!
When I installed it as a service I only put the path in "binPath".
sc create WindowsService1 binPath="C:\temp".
Once I actually added the executable to the binPath parameter everything worked.
Changed it to sc create WindowsService1 binPath="C:\temp\WindowsService.exe" and it worked.
I know it is an Id10t error but Microsoft should really provide better messaging for the "sc" command. A message like "Cannot find file specified in the binPath parameter" would have been really helpful. Would have saved me about 6 hours of work.
Thanks everyone for reviewing and replying to this question.

Windows Service - UnauthorizedAccessException Error when Installing Service (C#)

So I am trying to create a service using C# in Visual Studio 2017 and I keep getting an error when I try to install it.
Right now, I don't even have anything in my service, I just want to be able to install the service. I created a new Project in Visual Studio 2017 using the Windows Service (.NET Framework) template under Visual C# > Windows Desktop. I then added the installer via Right Click > Add Installer. For serviceProcessInstaller1, I set the account to LocalSystem. And...that's it!
Now, I try to install it. I open up command prompt (run as administrator) and I do
InstallUtil ServiceTest.exe
Things start off smoothly, but then I get a message:
"An exception occured during the Install phase.
System.UnauthorizedAccessException: Attempted to perform an
unauthorized operation."
What could be generating this message?
I've googled and tried the following things:
Ensure I run command prompt as administrator.
Assign Full Control to
the project folder to my admin account.
Configure permissions to Full
Control for admin account in the security log of regedit.
Log into my
computer as an administrator (rather than regular user) and run it
that way.
Despite these things, I keep getting the same error. What else could I be doing wrong? Would really appreciate some advice!
Note: I am trying to install this service locally on my computer.
Edit: Per request, here are the logs. I named my project "FailedService", by the way, since I can't get it to work!
InstallUtil.InstallLog
Running a transacted installation.
Beginning the Install phase of the installation.
See the contents of the log file for the C:\Users\first.m.last\source\repos\FailedService\FailedService\bin\Debug\FailedService.exe assembly's progress.
The file is located at C:\Users\first.m.last\source\repos\FailedService\FailedService\bin\Debug\FailedService.InstallLog.
An exception occurred during the Install phase.
System.UnauthorizedAccessException: Attempted to perform an unauthorized operation.
The Rollback phase of the installation is beginning.
See the contents of the log file for the C:\Users\first.m.last\source\repos\FailedService\FailedService\bin\Debug\FailedService.exe assembly's progress.
The file is located at C:\Users\first.m.last\source\repos\FailedService\FailedService\bin\Debug\FailedService.InstallLog.
The Rollback phase completed successfully.
The transacted install has completed.
FailedService.InstallLog
Installing assembly 'C:\Users\first.m.last\source\repos\FailedService\FailedService\bin\Debug\FailedService.exe'.
Affected parameters are:
logtoconsole =
logfile = C:\Users\first.m.last\source\repos\FailedService\FailedService\bin\Debug\FailedService.InstallLog
assemblypath = C:\Users\first.m.last\source\repos\FailedService\FailedService\bin\Debug\FailedService.exe
Installing service Service1...
Creating EventLog source Service1 in log Application...
Rolling back assembly 'C:\Users\first.m.last\source\repos\FailedService\FailedService\bin\Debug\FailedService.exe'.
Affected parameters are:
logtoconsole =
logfile = C:\Users\first.m.last\source\repos\FailedService\FailedService\bin\Debug\FailedService.InstallLog
assemblypath = C:\Users\first.m.last\source\repos\FailedService\FailedService\bin\Debug\FailedService.exe
Restoring event log to previous state for source Service1.

I was FINALLY able to resolve this issue. I was able to get to the bottom of it by using SysInternal's Process Monitor. I opened up the program and had it take logs for InstallUtil.exe. From there, I began to search for any logs that said "Access Denied". As I sorted through them, I noticed something interesting: it was trying to create a registry key, but it kept failing!
So I went into the registry and created a key named "ServiceTest". After that, I ran the InstallUtil command again, and it worked!
If anyone else is having trouble, the solution is to create a key named after your process name in the following location:
HKLM\System\CurrentControlSet\Services\EventLog\Application\

Enter the full path to installUtil & your service binary in an elevated prompt, that could do.

Windows, Start service System.InvalidOperationException: Cannot start service on computer '.' Access in Denied(Running as Admin)

I am trying to start service using the below code. This works fine for 99% machines but i get this issue on user machines. Any help to be able to reproduce this error or why this issue happens.
ServiceController sc = new ServiceController(name);
if (sc.Status == ServiceControllerStatus.Running ||
sc.Status == ServiceControllerStatus.StartPending)
{
sc.WaitForStatus(ServiceControllerStatus.Running);
Logger.Info("Service already running");
return true;
}
sc.Start();
Error I receive is
System.InvalidOperationException: Cannot start service on computer
'.'. ---> System.ComponentModel.Win32Exception: Access is denied
I am running with Administrator privileges
When creating the service I also run sc sdset command to make service start stop by non admin processes.

There is a whole thread about it in social msdn. The issue persisted for numerous users and it seems you do not have enough privileges to start the service, in which case you will have to change the service into Administrative account:
make sure that the service is set to Local Account by:
Rightclick on the property(in Services.msc panel).
select the Log on option
And then check again to see if it's working.

I am assuming you are trying to achieve a scenario similar to this, i.e., install a service and start it automatically.
Assuming you have made sure that you are really running as Administrator, i.e., the Admin command prompt or Run As Administrator.
Also, assuming you have restarted the machine to make sure that old version of your service is really removed, as you have tried multiple times to install / uninstall your service.
The error Access is denied essentially means that the user running it does not have access. Since you have said that you are running as Administrator, it is possibly that even Administrator does not have access to start the service. May be you are in a locked down environment (likely via Group Policy), where only the Domain Administrator is the "most powerful" !
The next step would be to investigate the permissions your service has. A useful tool for this is: SubInAcl
https://ss64.com/nt/subinacl.html
Display or modify Access Control Entries (ACEs) for file and folder Permissions, Ownership and Domain.
SubInAcl /service "your service name"
The above command is not easy to use ! You need to download it from the Microsoft web site.
Another useful tool is the SC command. This would normally be available by default.
Service Control - Create, Start, Stop, Query or Delete any Windows SERVICE.
SC sdshow "your service name"
would give details of the permission.
This would give you data which can help in further investigation.
You could also start / stop the service with this command. You can try with this to check whether you are getting the same exception when using this tool as well.
The following serverfault question gives some details about setting permission to a service
https://serverfault.com/questions/187302/how-do-i-grant-start-stop-restart-permissions-on-a-service-to-an-arbitrary-user
If you want to see the Stack trace from installutil you can use the /ShowcallStack option
https://learn.microsoft.com/en-us/dotnet/framework/tools/installutil-exe-installer-tool
/ShowCallStack
Outputs the call stack to the log file if an exception occurs at any point during installation.

This is not an answer, it is my further exploration of the question.
Here is the log
Running a transacted installation.
Beginning the Install phase of the installation.
See the contents of the log file for the
D:\devnet10\Flight\Flight.ServiceHost\bin\Debug\flight.servicehost.exe assembly's progress.
The file is located at D:\devnet10\Flight\Flight.ServiceHost\bin\Debug\flight.servicehost.InstallLog.
An exception occurred during the Install phase.
System.InvalidOperationException: An exception occurred in the OnAfterInstall event handler of Flight.ServiceHost.Installation.
at System.Configuration.Install.Installer.Install(IDictionary stateSaver)
at Flight.ServiceHost.Installation.Install(IDictionary stateSaver) in D:\devnet10\Flight\Flight.ServiceHost\Installation.cs:line 36
at System.Configuration.Install.Installer.Install(IDictionary stateSaver)
at System.Configuration.Install.AssemblyInstaller.Install(IDictionary savedState)
at System.Configuration.Install.Installer.Install(IDictionary stateSaver)
at System.Configuration.Install.TransactedInstaller.Install(IDictionary savedState)
The inner exception System.InvalidOperationException was thrown with the following error message: Cannot start service PreFlight on computer '.'..
at System.ServiceProcess.ServiceController.Start(String[] args)
at System.ServiceProcess.ServiceController.Start()
at Flight.ServiceHost.Installation.OnAfterInstall(IDictionary savedState) in D:\devnet10\Flight\Flight.ServiceHost\Installation.cs:line 49
at System.Configuration.Install.Installer.Install(IDictionary stateSaver)
The inner exception System.ComponentModel.Win32Exception was thrown with the following error message: Access is denied.
The Rollback phase of the installation is beginning.
See the contents of the log file for the D:\devnet10\Flight\Flight.ServiceHost\bin\Debug\flight.servicehost.exe assembly's progress.
The file is located at D:\devnet10\Flight\Flight.ServiceHost\bin\Debug\flight.servicehost.InstallLog.
The Rollback phase completed successfully.
The transacted install has completed.
[Update]
I should mention that I am running WIndows 10
I managed to create an installer using an installer project, which does work.

The issue by me was RunningAsLocalService in topshelf, hope this helps someone.

Error starting ASP.NET State Service

I get the following error when trying to start the ASP.NET State Service:
Windows could not start the ASP.NET State Service service on Local Computer.
Error 2: The system cannot find the file specified.
Everything I found on google told me to go to the %windir%\Microsoft.NET\Framework\v1.1.4322 folder at the command prompt, and then type the following command: aspnet_regiis.exe -ir
which I did and didn't solve the problem. The path to the executable in my case is 2.0: C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe.
So I tried the same comand on the v2 folder and I get the error:
"An attempt was made to load a program with an incorrect format".
thanks in advace for any help

As stated here, it's trying to load the 32-bit version while you need the 64-bit. If this is applicable, open RegEdit (own risk and so on) and change HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\aspnet_state\ImagePath
from %SystemRoot%\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe to %SystemRoot%\Microsoft.NET\Framework64\v2.0.50727\aspnet_state.exe.

You not need reinstall this service.
Just find in services "ASP.NET State Server" and start it.
Also you can set up to start this service automaticaly in preferences.

Loss of admin privileges when Java program calls C# program to write to %ProgramData%

The scenario:
I have a Java based installer.
The Java based installer calls a C# program, whose job is to create a shortcut.
The shortcut location depends on if the installer is running as administrator or as a regular user. When running as admin, I'm trying to create a shortcut to "%ALLUSERSPROFILE%\Desktop", else I write to "%USERPROFILE%\Desktop".
My impression is that the issue seems to be a loss of administrative privilege when my Java program calls my C# shortcut maker program.
Notes:
I run my Java based installer as administrator (right click, run as administrator).
I'm able to verify the installer is running with administrator privileged because I can read registry keys that require administrative privilege.
I'm calling my C# program via 'Process process = Runtime.getRuntime().exec(command);'
When running the command manually through an administrative command prompt, the command works fine. (When outputting to "%ALLUSERSPROFILE%\Desktop")
When running the the same command manually, from a normal command prompt, I get System.UnauthorizedAccessException. (Which is to be expected). The program crashes in a similar was that it does when run from the installer.
The Exception:
Unhandled Exception: System.UnauthorizedAccessException: Access is
denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED)) at
IWshRuntimeLibrary.IWshShortcut.Save()
Any thoughts on what I'm missing? The installer needs to be flexible to run as both a normal user and as an administrator. How can I ensure this behavior?
Update 1
I attached a debugger to the C# program at runtime. It is throwing a:
DirectoryNoFoundException was unhandled
The system cannot find the path specified. (Exception from HRESULT: 0x80070003)
I added "mkdir" commands before my shortcutmaker commands. The mkdir commands, just ensure that the directories exist before trying to write to them.
Rebuilt the installer, ran it and when trying to mkdir "%ALLUSERSPROFILE%\Desktop", java throws an exception of
java.io.IOException: Cannot run program "mkdir": CreateProcess error=2, The system cannot find the file specified
java.io.IOException: Cannot run program "mkdir": CreateProcess error=2, The system cannot find the file specified
at java.lang.ProcessBuilder.start(Unknown Source)
at java.lang.Runtime.exec(Unknown Source)
at java.lang.Runtime.exec(Unknown Source)
at java.lang.Runtime.exec(Unknown Source)
At this point, it looks like my process isn't getting admin access
Process process = Runtime.getRuntime().exec(command);
I'm going to see if I can find anything else.
Update 2
The following gave me some info that I tried: Enterprise Logging not translating environment variables in XML Trace Listener fileName specification
It suggested that %ALLUSERSPROFILE% was not getting translated.
Instead of %ALLUSERSPROFILE%, I got the environment variable values via:
String allUsersProfile = System.getenv("ALLUSERSPROFILE");
String userProfile = System.getenv("USERPROFILE");
I was then able to supply the actual values to the C# program. But I'm still having issues.
From a admin console I can navigate to "c:\ProgramData\Start Menu", but if I run "explorer" with administrative priviledges, I can navigate to "c:\ProgramData" but not see anything past that... Through some looking, I found out that "c:\ProgramData\Start Menu" is a protected operating system file. So I turned on the setting to see it. So now I can see it, but not go into it.
Using system internals, I elevated an explorer.exe to "system" access and still can't go into the folder (System internal elevation reference: http://verbalprocessor.com/2007/12/05/running-a-cmd-prompt-as-local-system/)
I right clicked on the folder and checked out the security tab. It looks like even my "System" user has limited access. I find this a bit baffling, that I can run the command from an admin command prompt that will write the shortcut to the desktop, but going through this other process I cannot... I also find the access to be a bit inconsistent.