#1483 DesktopServerWatcher has failed with error: Access is denied (error code 5)

[J Frady]

A very straight forward silent install command produces a functioning VNC Server service on a normal Windows Server 2019 installation. The same silent install command completes successfully in a Windows Docker image, however the connection fails after prompting for password.

You can see my docker file here:

https://gist.github.com/jeremyfrady/ebb68ab2a03d2d49993c100800f71035

When ran in the container, the service is running and I can connect to it and receive the normal password prompt, however submitting an obviously correct password like "TEST" produces the following error log:

https://gist.github.com/jeremyfrady/2774fc6581a1f6369bf5a538f9bfed47

The viewer eventually responds with "Connection has been gracefully closed" approximately 1 minute later.

Any advice or requests for more info are very appreciated and a priority for me.

[Anton]

Hello.

I'm not sure the image has GUI.
Can you connect to your container by RDP?

[J Frady]

Hey there,

There is no support for RDP in any Windows container at this time. There was a hack for it, but that has been fixed in recent images.

I expect the image I'm running has the GUI components as it's the full windows image, not core or nano. How can I confirm it has necessary bits?

[Anton]

Can you try do not install service, just run tvnserver.exe inside the container?
First run
reg add "HKCU\SOFTWARE\TightVNC\Server" /v LogLevel /t REG_DWORD /d 9 /f
to write logs.
Usually tightvnc requires display to be connected so I do not know can it work in Docker.

[J Frady]

This produces the same errors as the silent install.

[ordinaryorange]

I might have some information to assist. I've managed to stand up the VNC server in a windows continer, and also discovered that the server is having trouble intercepting the GUI session. I've collected the logs (log level 9) from the server and posted them here
Happy to run any tests. I'm also keen to get this working.

[J Frady]

Thanks for contributing ordinaryorange. It looks like you've made it to at least the same place that I am stuck at.

[ordinaryorange]

Spent a few days further hacking on this issue. As a test I wrote some custom code to call various windows API's to grab a screenshot of process window. In all situations I can locate the window handle of a given process, which returns a width and height, but the image is black. After a lot of reading about windows sessions, window stations, and desktops, I've dicovered that user (containerAdministrator) processes in a windows container run in session 1 called "services". This session has a WinStation of \Windows\WindowStations\Service-0x0-a171$ which apparently is a non-interactive session. All my reading suggest we may need an interactive session for all of this to work. On a non docker windows install, an interactive session is usually labelled WinSta0 and is created by logging in, or in the the case of Remote Desktop Services, created by that service eg \Sessions\1\Windows\WindowStations\WinSta0.
If there were some way to programatically start an "interactive" session from the docker session, then the tightVNC server could be started in that session and should theoretically work. But I'm at the limit of my windows sessions knowledge at the moment, and I'm outa further ideas.