Can't run service as my Win username: "service did not start due to a logon failure"

[jklenk]

I cannot get the SageTV Service to run as my personal Windows username.

It will only run as "LocalSystem".

When I try to start it (from the SageTV Service Control or from the Windows Services window), with it set to my Windows username, I get the following error:

"The service did not start due to a logon failure."

- My Windows username is "John", and I have it entered as ".\John" in the SageTV service control (Sage put it that way).
- When I try using just "John", Service Control gives an immediate error that the username is invalid.
- My account has no password (so I leave it blank in the Service Control setup).
- I created a password for my account, but got the same results.
- I created a different Windows account (with a password), and got the same result for that.

Using the "LocalSystem" logon DOES work, so that is what I am currently using, but that is not acceptable because sometimes Windows resets the autologin registry key so it gets stuck at the Windows logon screen after reboot (I've seen this on multiple PCs so it is a Windows bug I'm sure).

I'm using Sage 4.0. The problem did NOT occur when I was using Sage 2.x (or maybe it only logged in as LocalSystem then?).

Thanks,
John

[Narflex]

Go into Control Panel->Administrative Tools->Services and then setup the SageTV logon user in there. At that point Windows will ask you to grant that user 'logon as service rights', then you can confirm that and then it will work in the service control app.

[jklenk]

I was able to get it to work by specifying the user in the Services window, but ONLY if the user has a password. Which is not good since I will never make a password just to get into Windows. (Without a password, Windows just gives another logon error when trying to start it from the Services window or from the SageTV Services Control.)

I had to resort to configuring it to login as Administrator, which does have a password.

You might want to add that to your FAQ and to the Services Control window. I think a lot of people will not use a password for their normal Windows account.

Thanks for the help,
John

[gplasky]

The only way Windows lets you log on to run a service is if the user name has a password.

Gerry

[ke6guj]

Originally Posted by jklenk

I think a lot of people will not use a password for their normal Windows account.

Just because people don't like to use a password doesn't make it right.

Now, you can set up XP to start up and not require a password to be entered. Less secure than normal, but more secure than no password at all.

Set a password for the account that you normally log in with, then at a DOS prompt type "control userpasswords2" without the quotes. A User Accounts box will appear. Uncheck the "users must enter a user name an password to use this computer". When you click OK or Apply, a popup will appear prompting you for a user name and password that you would like the computer to start up with.

[Opus4]

Originally Posted by jklenk

I was able to get it to work by specifying the user in the Services window, but ONLY if the user has a password.
...
You might want to add that to your FAQ and to the Services Control window.

BTW: This is in Chapter 2 of the PDF manual in your SageTV directory, where it describes using service mode while discussing initial setup.

- Andy

[AMCooper63]

I found that I had to have the ./ in front of my login name. I noticed it defaulted to this once. I corrected it to my login name and I never could get it to work. Then during one of the upgrades, I noticed that the ./ got preappended to my login name. I left it and it works.

[stanger89]

Actually it's .\ I believe. ./ would be for unix

[dshields]

After going thru all the issues described above, I still could not get the SageTV service to start using an account I created for it. It turns out that the service logon account for SageTV must have admin rights! Why?!! This isn't good.

[gplasky]

You would rather have any kind of ID being able to run a service on your machine? Of COURSE you want it so the account has admin rights. You want it limited. And that is why it requires a password also.

Gerry

[dshields]

Originally Posted by gplasky

Of COURSE you want it so the account has admin rights.
Gerry

Sorry, but that's just bad security advice. SageTV needs to fix this.

From MS:
Use a Least-Privilege Hierarchy for Service Deployment
You should use the account that has the least privilege required to run a service. Services deployed using accounts that have higher privileges should be redeployed using accounts that have lesser privileges.

A least-privilege hierarchy should use accounts in the following order:

1.
Local Service. This account is similar to Local System, although it has minimum privileges on the local computer. Services that log on as Local Service access network resources using a null session with anonymous credentials. The account's privileges must be limited to only those that are required for the successful operation of the service.

. . .

5.
Local administrator account. You should run a service as a local administrator account only if it is impractical to run it as Local Service, Network Service, a unique domain user account or the Local System account.
...
6.
Domain administrator account. Running a service with a domain administrator account is a worst-case security scenario.

[gplasky]

Originally Posted by gplasky

Of COURSE you want it so the account has admin rights. You want it limited. And that is why it requires a password also.

Gerry

Originally Posted by dshields

Sorry, but that's just bad security advice. SageTV needs to fix this

I said this because the Sage TV app requires it-NOT becasue it is a good idea. But Sage isn't the only app that does this. You DO realize that most worms will hack into the systems using the accounts with NO password. Plus you should rename the administrator account. Not doing this gives a hacker 50% entry into your system.

Gerry