wrapper-user

[Wrapper-user] Can run wrapped app, or install as service, but can't start ("Access denied")

[John C. <jm...@mu...>]

Windows XP.

I've configured a wrapper.conf file such that I can start my app from
a command window and it runs with no problem.  I run the install
script, and the app appears to have been installed as a service.  It's
configured to start up automatically, and no complaints appear
anywhere, until I try to Start this service.  Then I get the message,

"Could not start the <MyApp> service on Local Computer./ Error 5:
Access is denied."

Essentially the same message appears when I use "net start".  If I
look at the Properties of the service, and copy the command to a
Command window, the expected thing happens if I leave the "-s" in
place, but if I change to a "-t" I again get "Access is denied" but
this comes from the Wrapper logger.  If I change the flag to "-c",
everything appears to work fine.

I don't know how to get either the Wrapper or Windows (which is where
I suspect the problem lies, but I can't be sure) to be any more
expansive as to what resource I'm being denied access to.  Does anyone
have any clues or suggestions?

Thanks.

-jmc

[Wrapper-user] Can run wrapped app, or install as service, but can't start ("Access denied")

[John C. <jm...@mu...>]

On Windows XP, I've configured a wrapper.conf file such that I can
start my app from a command window and it runs with no problem.  I run
the install script, and the app appears to have been installed as a
service.  It's configured to start up automatically, and no complaints
appear anywhere, until I try to Start this service.  Then I get the
message,

"Could not start the <MyApp> service on Local Computer./ Error 5:
Access is denied."

Essentially the same message appears when I use "net start".  If I
look at the Properties of the service, and copy the command to a
Command window, the expected thing happens if I leave the "-s" in
place, but if I change to a "-t" I again get "Access is denied" but
this comes from the Wrapper logger.  If I change the flag to "-c",
everything appears to work fine.

I don't know how to get either the Wrapper or Windows (which is where
I suspect the problem lies, but I can't be sure) to be any more
expansive as to what resource I'm being denied access to.  Does anyone
have any clues or suggestions?

Thanks.

-jmc

Re: [Wrapper-user] Can run wrapped app, or install as service, but can't start ("Access denied")

[Hubert F. <hub...@ab...>]

What account do you use for the service to run?=20
Does it run with "localSystem" account? If not, then ....

Start the Local Security Settings console from the Administrative Tools =
group.
2.	Navigate to User Rights Assignments under Local Policies.
3.	Verify that the Service account has explicitly been given the =
following rights:
*	Log on as a service
*	Act as part of the operating system

Depending on what your service does it might be necessary to  assign more =
rights.



>>> John Chandler <jm...@mu...> 19.07.2007 22:08 >>>
On Windows XP, I've configured a wrapper.conf file such that I can
start my app from a command window and it runs with no problem.  I run
the install script, and the app appears to have been installed as a
service.  It's configured to start up automatically, and no complaints
appear anywhere, until I try to Start this service.  Then I get the
message,

"Could not start the <MyApp> service on Local Computer./ Error 5:
Access is denied."

Essentially the same message appears when I use "net start".  If I
look at the Properties of the service, and copy the command to a
Command window, the expected thing happens if I leave the "-s" in
place, but if I change to a "-t" I again get "Access is denied" but
this comes from the Wrapper logger.  If I change the flag to "-c",
everything appears to work fine.

I don't know how to get either the Wrapper or Windows (which is where
I suspect the problem lies, but I can't be sure) to be any more
expansive as to what resource I'm being denied access to.  Does anyone
have any clues or suggestions?

Thanks.

-jmc

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2005.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/=20
_______________________________________________
Wrapper-user mailing list
Wra...@li...=20
https://lists.sourceforge.net/lists/listinfo/wrapper-user

Re: [Wrapper-user] Can run wrapped app, or install as service, but can't start ("Access denied")

[John C. <jm...@mu...>]

Thanks, I hadn't added the "part of operating system" right.  Since
this machine is behind a firewall, on a private network, I added
"Everyone" *and* several other users individually.  Unfortunately,
"Start" still fails.

When you ask which account I use, I just use my normal login account
to do the Start.  Is there something else I should be doing?  Is there
something in the conf file that sets an account (I don't see anything
like this)?

On the question of what the service does this is a test service, and
it doesn't do much -- it checks the last-modified time of a file and
*may* invoke COMMAND to do a copy -- but when started as a service, it
doesn't even appear to be able to write an entry in its log.  If I
attempt to add the service again, not using the install script, just
"wrapper.exe -i <conf-file>", with "c:\" as the working directory, I
do get a log entry about the service already being installed.

-jmc

Hubert Felber writes:
 > What account do you use for the service to run? 
 > Does it run with "localSystem" account? If not, then ....
 > 
 > Start the Local Security Settings console from the Administrative Tools group.
 > 2.	Navigate to User Rights Assignments under Local Policies.
 > 3.	Verify that the Service account has explicitly been given the following rights:
 > *	Log on as a service
 > *	Act as part of the operating system
 > 
 > Depending on what your service does it might be necessary to  assign more rights.
 > 
 > 
 > 
 > >>> John Chandler <jm...@mu...> 19.07.2007 22:08 >>>
 > On Windows XP, I've configured a wrapper.conf file such that I can
 > start my app from a command window and it runs with no problem.  I run
 > the install script, and the app appears to have been installed as a
 > service.  It's configured to start up automatically, and no complaints
 > appear anywhere, until I try to Start this service.  Then I get the
 > message,
 > 
 > "Could not start the <MyApp> service on Local Computer./ Error 5:
 > Access is denied."
 > 
 > Essentially the same message appears when I use "net start".  If I
 > look at the Properties of the service, and copy the command to a
 > Command window, the expected thing happens if I leave the "-s" in
 > place, but if I change to a "-t" I again get "Access is denied" but
 > this comes from the Wrapper logger.  If I change the flag to "-c",
 > everything appears to work fine.
 > 
 > I don't know how to get either the Wrapper or Windows (which is where
 > I suspect the problem lies, but I can't be sure) to be any more
 > expansive as to what resource I'm being denied access to.  Does anyone
 > have any clues or suggestions?
 > 
 > Thanks.
 > 
 > -jmc
 > 
 > -------------------------------------------------------------------------
 > This SF.net email is sponsored by: Microsoft
 > Defy all challenges. Microsoft(R) Visual Studio 2005.
 > http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/ 
 > _______________________________________________
 > Wrapper-user mailing list
 > Wra...@li... 
 > https://lists.sourceforge.net/lists/listinfo/wrapper-user
 > 
 > 
 > -------------------------------------------------------------------------
 > This SF.net email is sponsored by: Microsoft
 > Defy all challenges. Microsoft(R) Visual Studio 2005.
 > http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
 > _______________________________________________
 > Wrapper-user mailing list
 > Wra...@li...
 > https://lists.sourceforge.net/lists/listinfo/wrapper-user
 > 

Re: [Wrapper-user] Can run wrapped app, or install as service, but can't start ("Access denied")

[Hubert F. <hub...@ab...>]

Before playing with user accounts, did you try the configuration on the
following link?
http://wrapper.tanukisoftware.org/doc/english/props-example-config.html


Follow the advise and replace the necessary items. Keep in mind, the
all directories are relative to the location of wrapper.exe.
Your service will then run with localsystem account, the account a
service should use, if possible.

If this works, try to modify the config until it fits your needs.  Read
the wrapper docs to check the difference between a service running with
localSystem account and a service running with a regular user account.
hth 
Hubert


>>> John Chandler <jm...@mu...> 20.07.2007 18:02 >>>
Thanks, I hadn't added the "part of operating system" right.  Since
this machine is behind a firewall, on a private network, I added
"Everyone" *and* several other users individually.  Unfortunately,
"Start" still fails.

When you ask which account I use, I just use my normal login account
to do the Start.  Is there something else I should be doing?  Is there
something in the conf file that sets an account (I don't see anything
like this)?

On the question of what the service does this is a test service, and
it doesn't do much -- it checks the last-modified time of a file and
*may* invoke COMMAND to do a copy -- but when started as a service, it
doesn't even appear to be able to write an entry in its log.  If I
attempt to add the service again, not using the install script, just
"wrapper.exe -i <conf-file>", with "c:\" as the working directory, I
do get a log entry about the service already being installed.

-jmc

Hubert Felber writes:
 > What account do you use for the service to run? 
 > Does it run with "localSystem" account? If not, then ....
 > 
 > Start the Local Security Settings console from the Administrative
Tools group.
 > 2.	Navigate to User Rights Assignments under Local Policies.
 > 3.	Verify that the Service account has explicitly been given the
following rights:
 > *	Log on as a service
 > *	Act as part of the operating system
 > 
 > Depending on what your service does it might be necessary to  assign
more rights.
 > 
 > 
 > 
 > >>> John Chandler <jm...@mu...> 19.07.2007 22:08 >>>
 > On Windows XP, I've configured a wrapper.conf file such that I can
 > start my app from a command window and it runs with no problem.  I
run
 > the install script, and the app appears to have been installed as a
 > service.  It's configured to start up automatically, and no
complaints
 > appear anywhere, until I try to Start this service.  Then I get the
 > message,
 > 
 > "Could not start the <MyApp> service on Local Computer./ Error 5:
 > Access is denied."
 > 
 > Essentially the same message appears when I use "net start".  If I
 > look at the Properties of the service, and copy the command to a
 > Command window, the expected thing happens if I leave the "-s" in
 > place, but if I change to a "-t" I again get "Access is denied" but
 > this comes from the Wrapper logger.  If I change the flag to "-c",
 > everything appears to work fine.
 > 
 > I don't know how to get either the Wrapper or Windows (which is
where
 > I suspect the problem lies, but I can't be sure) to be any more
 > expansive as to what resource I'm being denied access to.  Does
anyone
 > have any clues or suggestions?
 > 
 > Thanks.
 > 
 > -jmc
 > 
 >
-------------------------------------------------------------------------
 > This SF.net email is sponsored by: Microsoft
 > Defy all challenges. Microsoft(R) Visual Studio 2005.
 > http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/ 
 > _______________________________________________
 > Wrapper-user mailing list
 > Wra...@li... 
 > https://lists.sourceforge.net/lists/listinfo/wrapper-user 
 > 
 > 
 >
-------------------------------------------------------------------------
 > This SF.net email is sponsored by: Microsoft
 > Defy all challenges. Microsoft(R) Visual Studio 2005.
 > http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/ 
 > _______________________________________________
 > Wrapper-user mailing list
 > Wra...@li... 
 > https://lists.sourceforge.net/lists/listinfo/wrapper-user 
 > 

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2005.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/ 
_______________________________________________
Wrapper-user mailing list
Wra...@li... 
https://lists.sourceforge.net/lists/listinfo/wrapper-user

Re: [Wrapper-user] Can run wrapped app, or install as service, but can't start ("Access denied")

[Leif M. <le...@ta...>]

John,
That message is most likely coming from the Service Manager so it
will not be an issue with the Wrapper configuration.  You can confirm
this by checking your wrapper.log file and making sure that it does
not contain any output from the service attempting to be run.
Also check for a wrapper.log file under the windows and
windows\system32 directories.

As Hubert said, it could be a problem with your security policy.

 From your  response, you are not setting an account run as.  correct?
That would mean that you are running as the SYSTEM account.

Where do you have your wrapper.exe?  Is it possible that there are
some security restrictions set on the directory that would be
preventing the SYSTEM user from accessing the wrapper binary.
I have had problems from users in the past before that turned out
to be this sort of thing.

Cheers,
Leif

John Chandler wrote:
> On Windows XP, I've configured a wrapper.conf file such that I can
> start my app from a command window and it runs with no problem.  I run
> the install script, and the app appears to have been installed as a
> service.  It's configured to start up automatically, and no complaints
> appear anywhere, until I try to Start this service.  Then I get the
> message,
>
> "Could not start the <MyApp> service on Local Computer./ Error 5:
> Access is denied."
>
> Essentially the same message appears when I use "net start".  If I
> look at the Properties of the service, and copy the command to a
> Command window, the expected thing happens if I leave the "-s" in
> place, but if I change to a "-t" I again get "Access is denied" but
> this comes from the Wrapper logger.  If I change the flag to "-c",
> everything appears to work fine.
>
> I don't know how to get either the Wrapper or Windows (which is where
> I suspect the problem lies, but I can't be sure) to be any more
> expansive as to what resource I'm being denied access to.  Does anyone
> have any clues or suggestions?
>
> Thanks.
>
> -jmc
>
> -------------------------------------------------------------------------
> This SF.net email is sponsored by: Microsoft
> Defy all challenges. Microsoft(R) Visual Studio 2005.
> http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
> _______________________________________________
> Wrapper-user mailing list
> Wra...@li...
> https://lists.sourceforge.net/lists/listinfo/wrapper-user
>
>   

Re: [Wrapper-user] Can run wrapped app, or install as service, but can't start ("Access denied")

[John C. <jm...@mu...>]

Leif Mortenson writes:
 > John,
 > That message is most likely coming from the Service Manager so it
 > will not be an issue with the Wrapper configuration.  You can confirm
 > this by checking your wrapper.log file and making sure that it does
 > not contain any output from the service attempting to be run.
 > Also check for a wrapper.log file under the windows and
 > windows\system32 directories.

This confirms what I thought.  No wrapper.log file under windows, and
no entries from the server trying to start.  When I invoke the wrapper
with the "-t" switch, I get log-like output on the screen though:

wrapper  | Starting the Test Service service...
wrapper  | Unable to start the service - Access is denied. (0x5)

 > As Hubert said, it could be a problem with your security policy.
 > 
 >  From your  response, you are not setting an account run as.  correct?
 > That would mean that you are running as the SYSTEM account.

Correct.  This is a simple laptop with no domain hoohah that *I* am
aware of, so from the doc, it appears the syntax for that would be

wrapper.ntservice.account=.\theaccountname

with no quotation marks.  I set it that way (using the account I've
been logged in as), tried the start, and got a logon failure.  Then I
removed the dot, and got a different error, which maybe you can
interpret:

Error 1068: The dependency service or group failed to start

No entry was made in the wrapper log.  Since I didn't get a logon
failure, I infer that the account name is set to something that can be
logged on with.  Any idea if/where there might be a log with more
detail about what the problem with the "dependency service or group"
might have been?  I looked in WINDOWS and WINDOWS\sytem32, and nothing
with a recent time on it seemed to have any info about this in it.

By the way, when I use the "-r" switch, to remove a service, it
becomes "flagged for deletion" but not really removed, so that the
same service can't be re-installed.  A reboot causes the removal to
take effect, but also destroys all of my development context, so I'm
wondering if there is a way to get the old version of the service out
of the way without rebooting.  Currently I'm making minor changes to
the service name, which lets me do another install, but that seems
kind of hokey.

 > Where do you have your wrapper.exe?  Is it possible that there are
 > some security restrictions set on the directory that would be
 > preventing the SYSTEM user from accessing the wrapper binary.
 > I have had problems from users in the past before that turned out
 > to be this sort of thing.

I suppose it's possible, but I put everything (conf, bin, log...) in a
directory that I created with the same account I'm using when I pull
up the Services panel.  Is there a way to verify that all perms are
granted?  Or just set them to maximum permissiveness?

Thanks.

-jmc

 > Cheers,
 > Leif
 > 
 > John Chandler wrote:
 > > On Windows XP, I've configured a wrapper.conf file such that I can
 > > start my app from a command window and it runs with no problem.  I run
 > > the install script, and the app appears to have been installed as a
 > > service.  It's configured to start up automatically, and no complaints
 > > appear anywhere, until I try to Start this service.  Then I get the
 > > message,
 > >
 > > "Could not start the <MyApp> service on Local Computer./ Error 5:
 > > Access is denied."
 > >
 > > Essentially the same message appears when I use "net start".  If I
 > > look at the Properties of the service, and copy the command to a
 > > Command window, the expected thing happens if I leave the "-s" in
 > > place, but if I change to a "-t" I again get "Access is denied" but
 > > this comes from the Wrapper logger.  If I change the flag to "-c",
 > > everything appears to work fine.
 > >
 > > I don't know how to get either the Wrapper or Windows (which is where
 > > I suspect the problem lies, but I can't be sure) to be any more
 > > expansive as to what resource I'm being denied access to.  Does anyone
 > > have any clues or suggestions?
 > >
 > > Thanks.
 > >
 > > -jmc
 > >
 > > -------------------------------------------------------------------------
 > > This SF.net email is sponsored by: Microsoft
 > > Defy all challenges. Microsoft(R) Visual Studio 2005.
 > > http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
 > > _______________________________________________
 > > Wrapper-user mailing list
 > > Wra...@li...
 > > https://lists.sourceforge.net/lists/listinfo/wrapper-user
 > >
 > >   
 > 
 > 
 > -------------------------------------------------------------------------
 > This SF.net email is sponsored by: Microsoft
 > Defy all challenges. Microsoft(R) Visual Studio 2005.
 > http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
 > _______________________________________________
 > Wrapper-user mailing list
 > Wra...@li...
 > https://lists.sourceforge.net/lists/listinfo/wrapper-user
 > 

Re: [Wrapper-user] Can run wrapped app, or install as service, but can't start ("Access denied")

[Leif M. <le...@ta...>]

John,
    Can you post your wrapper.conf file so I can get a better idea
of what you are doing?

Cheers,
Leif

John Chandler wrote:
> Leif Mortenson writes:
>  > John,
>  > That message is most likely coming from the Service Manager so it
>  > will not be an issue with the Wrapper configuration.  You can confirm
>  > this by checking your wrapper.log file and making sure that it does
>  > not contain any output from the service attempting to be run.
>  > Also check for a wrapper.log file under the windows and
>  > windows\system32 directories.
>
> This confirms what I thought.  No wrapper.log file under windows, and
> no entries from the server trying to start.  When I invoke the wrapper
> with the "-t" switch, I get log-like output on the screen though:
>
> wrapper  | Starting the Test Service service...
> wrapper  | Unable to start the service - Access is denied. (0x5)
>
>  > As Hubert said, it could be a problem with your security policy.
>  > 
>  >  From your  response, you are not setting an account run as.  correct?
>  > That would mean that you are running as the SYSTEM account.
>
> Correct.  This is a simple laptop with no domain hoohah that *I* am
> aware of, so from the doc, it appears the syntax for that would be
>
> wrapper.ntservice.account=.\theaccountname
>
> with no quotation marks.  I set it that way (using the account I've
> been logged in as), tried the start, and got a logon failure.  Then I
> removed the dot, and got a different error, which maybe you can
> interpret:
>
> Error 1068: The dependency service or group failed to start
>
> No entry was made in the wrapper log.  Since I didn't get a logon
> failure, I infer that the account name is set to something that can be
> logged on with.  Any idea if/where there might be a log with more
> detail about what the problem with the "dependency service or group"
> might have been?  I looked in WINDOWS and WINDOWS\sytem32, and nothing
> with a recent time on it seemed to have any info about this in it.
>
> By the way, when I use the "-r" switch, to remove a service, it
> becomes "flagged for deletion" but not really removed, so that the
> same service can't be re-installed.  A reboot causes the removal to
> take effect, but also destroys all of my development context, so I'm
> wondering if there is a way to get the old version of the service out
> of the way without rebooting.  Currently I'm making minor changes to
> the service name, which lets me do another install, but that seems
> kind of hokey.
>
>  > Where do you have your wrapper.exe?  Is it possible that there are
>  > some security restrictions set on the directory that would be
>  > preventing the SYSTEM user from accessing the wrapper binary.
>  > I have had problems from users in the past before that turned out
>  > to be this sort of thing.
>
> I suppose it's possible, but I put everything (conf, bin, log...) in a
> directory that I created with the same account I'm using when I pull
> up the Services panel.  Is there a way to verify that all perms are
> granted?  Or just set them to maximum permissiveness?
>
> Thanks.
>
> -jmc
>
>  > Cheers,
>  > Leif
>  > 
>  > John Chandler wrote:
>  > > On Windows XP, I've configured a wrapper.conf file such that I can
>  > > start my app from a command window and it runs with no problem.  I run
>  > > the install script, and the app appears to have been installed as a
>  > > service.  It's configured to start up automatically, and no complaints
>  > > appear anywhere, until I try to Start this service.  Then I get the
>  > > message,
>  > >
>  > > "Could not start the <MyApp> service on Local Computer./ Error 5:
>  > > Access is denied."
>  > >
>  > > Essentially the same message appears when I use "net start".  If I
>  > > look at the Properties of the service, and copy the command to a
>  > > Command window, the expected thing happens if I leave the "-s" in
>  > > place, but if I change to a "-t" I again get "Access is denied" but
>  > > this comes from the Wrapper logger.  If I change the flag to "-c",
>  > > everything appears to work fine.
>  > >
>  > > I don't know how to get either the Wrapper or Windows (which is where
>  > > I suspect the problem lies, but I can't be sure) to be any more
>  > > expansive as to what resource I'm being denied access to.  Does anyone
>  > > have any clues or suggestions?
>  > >
>  > > Thanks.
>  > >
>  > > -jmc
>  > >