Security/Privileges for App spawned from Service 1

[tgreer]

This is a re-hash of a previous posting, with greater specificity.

I get the following error:

An unhandled exception of type 'System.IO.DirectoryNotFoundException' occurred in mscorlib.dll

Additional information: Could not find a part of the path "z:\".

The code that causes the error:

if (!Directory.Exists(sack_destination + tape_name))
{
Directory.CreateDirectory(sack_destination + tape_name);
}

"sack_destination" is a string that equates to "z:\mer". This is a mapped drive, a network share.

The code is contained in a Console Application, which is launched from a Windows Service application using System.Diagnostics.Process.Start.

I have tried running the service under the LocalSystem account, and as a local user account with Administrative + "run as service" privileges. The same error in each case.

I also tried running the service under NetworkResource account, but the service failed to start, with no specific error message, so I'm not sure what the problem is there.

The error does NOT occur when I manually run or debug the Console application.

What privileges are needed in order for an application spawned by a service to access network resources? Can those privileges be granted programmatically? In other words, can the service launch the process with specific credentials? If so, how (code snippet)?

Thomas D. Greer

Providing PostScript & PDF
Training, Development & Consulting

 

[tgreer]

Well, I'll just answer my own question, for the benefit of any who encounter the same issue.

Drive Mapping.

Services essentially create their own "Login Context", and the same hold true for the processes they spawn. Thus, the LocalSystem account doesn't have access to the drive mappings available to any particular user.


Answer: Use UNC paths instead of drive mappings. Also, the service must log on as a user account with rights to those shares, instead of LocalSystem.



Thomas D. Greer

Providing PostScript & PDF
Training, Development & Consulting

 

[brd24gor]

Helpful information (even though you answered your own question!). Deserves a star.

 

[RexHeadlong]

I don't know if anyone will read this since the original thread was so long ago...

I have a related question for tgreer:

I am trying to accomplish the same thing, but without using UNC paths. If the original share is read/write for everybody, and I map a drive letter to the share, will this solution work if my service logs on as any user account?

Or, is my only hope to use UNC paths?

Thanks for any help. If I don't get a reply soon, I guess I'll just repost.

 

[tgreer]

I don't know. Seems like you could test that fairly easily, couldn't you?

Thomas D. Greer

http://www.tgreer.com

 

[RexHeadlong]

Yah, but I thought you might have the answer already ;-)

Thanks anyway.

 

[tgreer]

Nope, I stopped once I had my answer!

Thomas D. Greer

http://www.tgreer.com