Unable to start a C++ Windows Service

Question

I tried creating a Windows service in C++ using this code sample on MSDN. I opened the solution file in Visual Studio 2013 as admin. The build was successful. Then I installed the service, as per the description provided with the code sample, from a command prompt opened as administrator. The service is now shown in the Services tool in my system. However, when I try to start the service, I get error 5: Access is denied.

The output of sc qc CppWindowsService is as follows:

    [SC] QueryServiceConfig SUCCESS

    SERVICE_NAME: CppWindowsService
    TYPE               : 10  WIN32_OWN_PROCESS
    START_TYPE         : 3   DEMAND_START
    ERROR_CONTROL      : 1   NORMAL
    BINARY_PATH_NAME   : C:\Users\Aaa\Documents\CppWindowsService\C++\Debug\CppWindowsService.exe
    LOAD_ORDER_GROUP   :
    TAG                : 0
    DISPLAY_NAME       : CppWindowsService Sample Service
    DEPENDENCIES       :
    SERVICE_START_NAME : NT AUTHORITY\LocalService

Why does this happen, and how can I fix it?

Attach a debugger to the service and find out what operation is generating the exception? — Martin James, Jul 21 '15 at 11:42
@MartinJames: I manually gave the Start option.. How to attach debugger? — Jackzz, Jul 21 '15 at 11:45
Under visual studio, tools -> Attach to process. or ctrl+alt+p. If the service does not appear in the list, click on Show processes from all users — Pumkko, Jul 21 '15 at 11:48
@Pumkko: it doesnt show my service...It seems the service should be running.. I cannot start the service.. — Jackzz, Jul 21 '15 at 11:51
@Jackz Maybe this can help you ? http://stackoverflow.com/a/574430/5076707 — Pumkko, Jul 21 '15 at 12:01
Try using `sc start` at the elevated command prompt to start the service. If that doesn't work either, use `sc qc` to check the service configuration - please copy and paste the output into your question. — Harry Johnston, Jul 21 '15 at 21:30
Have you check the windows event log to see why the service failed to start? A debugger can help only if your service can start. If it cannot be started, your debugger can attach to no process to debug. — simon, Jul 21 '15 at 12:17

Harry Johnston · Answer 1 · 2015-07-22T04:32:28.773

Because the executable file is in your personal Documents folder, the local service account doesn't have access to it.

The easiest resolution would be to change the permissions on the Debug folder to give SERVICE read and execute access, with inheritance enabled. From the command line:

icacls Debug /grant SERVICE:(OI)(CI)(RX)

(Because Windows does not do traverse checking in the default configuration, you do not need to change the permissions for the parent folders.)

Another option is to copy the executable file to a public location (such as inside Program Files) and install it there, but you then have to remember to manually update the copy each time you recompile.

Edit: yet another option, as you suggest, is to change the account to local system so that the service is running with administrative privileges. Best practice is to run services with the least privilege necessary, but at this stage it doesn't matter much.

Yes.. the issue was with LocalService account.. Changing account to local system helped me.. Thank you for this information.. — Jackzz, Jul 22 '15 at 04:31

score 0 · Accepted Answer · answered Jul 22 '15 at 04:31

The comment provided by @Pumkko helped to solve the issue... The service account was specified as LocalService (#define SERVICE_ACCOUNT L"NTAUTHORITY\\LocalService"). From here:

The Local Service account didn't have permissions to the output .exe file, and this was why the error was occuring.

I changed the account type to LocalSystem (#define SERVICE_ACCOUNT L"LocalSystem") and now my service can be started.

Thankyou @Pumkko and @Harry Johnston.

Unable to start a C++ Windows Service

2 Answers2