How to run a separate process as a domain user with a 'local system' service?

Question

I have this following simple service program:

using System.Diagnostics;
using System.ServiceProcess;

namespace BasicService
{
    public partial class Service1 : ServiceBase
    {
        public Service1()
        {
            InitializeComponent();
        }

        protected override void OnStart(string[] args)
        {
            ProcessStartInfo processStartInfo = new ProcessStartInfo
                                                    {
                                                        Verb = "runas",
                                                        UserName = "jdoe",
                                                        Password = "XXXXXXX".ConvertToSecureString(),
                                                        Domain = "abc.com",
                                                        UseShellExecute =false,
                                                        FileName = "notepad.exe"
                                                    };
            Process.Start(processStartInfo);
        }

        protected override void OnStop()
        {
        }
    }
}

And I'm using this as my service installer:

using System.ComponentModel;
using System.Configuration.Install;
using System.ServiceProcess;

namespace BasicService
{
    [RunInstaller(true)]
    public class ProjectInstaller : Installer
    {
        private readonly ServiceProcessInstaller _process;
        private readonly ServiceInstaller _service;

        public ProjectInstaller()
        {
            _process = new ServiceProcessInstaller {Account = ServiceAccount.LocalSystem};
            _service = new ServiceInstaller
                           {
                               ServiceName = "BasicService",
                               Description = "Just a testing service.",
                               StartType = ServiceStartMode.Automatic,
                           };

            Installers.Add(_process);
            Installers.Add(_service);
        }
    }
}

If I run this service without a verb, username, password, domain and useshellexecute specified, everything runs just dandy. As soon as I specify these values as seen above, I get the following:

Service cannot be started. System.ComponentModel.Win32Exception (0x80004005): Access is denied at System.Diagnostics.Process.StartWithCreateProcess(ProcessStartInfo startInfo) at System.Diagnostics.Process.Start() at System.Diagnostics.Process.Start(ProcessStartInfo startInfo) at BasicService.Service1.OnStart(String[] args) in C:\BasicService\BasicService\Service1.cs:line 24 at System.ServiceProcess.ServiceBase.ServiceQueuedMainCallback(Object state)

Any ideas?

user1234883 user1234883 · Accepted Answer · 2012-02-27T08:20:29

Since Windows Vista, services cannot simply display ui or interact with a user.
http://msdn.microsoft.com/en-us/library/ms683502(VS.85).aspx

Thus, to run a GUI app from your service, you'll need to use CreateProcessAsUser, which is not directly available in .NET. So you'll have to rely on Pinvoke, somewhat similar as it is described here

http://blogs.msdn.com/b/alejacma/archive/2007/12/20/how-to-call-createprocesswithlogonw-createprocessasuser-in-net.aspx

How to run a separate process as a domain user with a 'local system' service?

1 Answers