{"id":1946,"date":"2016-02-01T05:57:01","date_gmt":"2016-02-01T13:57:01","guid":{"rendered":"http:\/\/www.coretechnologies.com\/blog\/?p=1946"},"modified":"2024-02-18T07:54:38","modified_gmt":"2024-02-18T15:54:38","slug":"windows-service-forgets-password","status":"publish","type":"post","link":"https:\/\/www.coretechnologies.com\/blog\/windows-services\/windows-service-forgets-password\/","title":{"rendered":"Why does my Windows Service keep forgetting its password?"},"content":{"rendered":"

The mystery: “The service did not start due to a login failure”<\/b><\/h2>\n

One of our customers reported a very strange problem last week. After about a day of running flawlessly, their windows service would suddenly fail to start after a reboot. The error reported by the Event Viewer<\/a> hinted at a problem with the service user’s account:
\n
\n\"Windows<\/a>\n<\/p>\n

Trying to start the service directly from the Windows Services Control Panel application<\/a> produced the same unsatisfying result:
\n
\n\"Windows<\/a>\n<\/p>\n

The service account’s password had not changed, and the user had no problem logging into the server interactively. Why was the windows service failing to login?<\/p>\n

Luckily we were able to get the service going again by re-entering the user’s password:
\n
\n\"Re-enter<\/a>\n<\/p>\n

When doing so, we noticed that the “Log on as a service” right had to be granted again. Very suspicious…
\n
\n\"Log<\/a>\n<\/p>\n

But a mere 24 hours later, the problem resurfaced! Once again, the service failed to start after a reboot.<\/p>\n

The problem: Group Policy overwriting Local Policy<\/b><\/h2>\n

The message about the “Log on as a service” right lead us to the root of the problem.<\/p>\n

Entering the password in services.msc updated the user’s rights in the machine’s Local Group Policy<\/a> — a collection of settings that define how the system will behave for the PC’s users. However, since the user and server were part of a domain, those local settings were periodically overwritten by the domain’s group policy<\/b>, which had not<\/b> been updated with the new permission. And because the necessary permission “disappeared” on the machine, the service failed the next time it tried to start.<\/p>\n

<\/a><\/p>\n

The solution: Modify the Domain Group Policy<\/b><\/h2>\n

To fix the problem, we must update the domain group policy and explicitly give the service user the “Log on as a service” right. To do so:<\/p>\n

    \n
  1. \n

    Start the Group Policy Management<\/b> application.<\/p>\n

    Open Control Panel, navigate to System and Security > Administrative Tools<\/b>, and double-click Group Policy Management<\/b> on the left.
    \n
    \n\"Start<\/a>\n<\/p>\n

    (Note: Don’t search for “group” in Control Panel. That will lead you to the “Edit group policy” link, which opens the local<\/b> group policy!)<\/p>\n<\/li>\n

  2. \n

    Find your default domain policy on the left. Right-click it and select Edit<\/b> to bring up the Group Policy Management Editor<\/b> window.
    \n
    \n\"Edit<\/a>\n<\/p>\n<\/li>\n

  3. \n

    On the left, navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment<\/b> and select
    \nthe Log on as a service<\/b> entry on the right.
    \n
    \n\"Edit<\/a>\n<\/p>\n<\/li>\n

  4. \n

    Double-click Log on as a service<\/b> to bring up its Properties<\/b> window.<\/p>\n

    Add the user running your windows service to the list and click OK to record the change.
    \n
    \n\"Add<\/a>\n<\/p>\n<\/li>\n<\/ol>\n

    <\/p>\n

    Next time your domain policy is copied to your server, it will bring along the Log on as a service right for the user. You shouldn’t encounter the “logon failure” error again!<\/p>\n

    A closing note for the folks at Microsoft: A better error message please!<\/b><\/h2>\n

    <\/b>Instead of reporting the generic “logon failure”, why not be more precise and say something like “The user doesn’t have the necessary rights to start the service”<\/b>? You could provide even more guidance by listing the missing rights.<\/p>\n

    The bottom line is a that a helpful error message highlighting the true problem would have led us straight to the solution and avoided a few anxious days for us and our client.<\/p>\n