Windows服务应用程序是否可以创建一个子进程，该进程以该服务运行的帐户以外的帐户登录？ [英] Can a Windows service application create a child process that signs in as an account other than the account that the service is running as?

问题描述

大家好，

我有C＃控制台应用程序做一件事 - 从SQL数据库中获取一行，然后尝试生成子进程。子进程将尝试使用多个硬编码域帐户中的一个 - 无论当前未使用哪个帐户。

我的应用程序是使用来自Nuget的Windows服务库Topshelf编写的。

当我直接运行我的应用程序而不是服务时，一切似乎都按预期工作。我的应用程序运行，获取SQL数据并生成所有登录到相应域帐户的子进程。

当我将应用程序作为服务运行时，事情似乎没有按计划进行。如果服务是作为本地服务登录的，或者使用"SYSTEM"登录。帐户，然后子进程似乎完全失败。我不太确定错误是什么，
呢。如果服务是作为前面提到的域帐户之一登录的，则它可以生成子进程，但只有使用运行该服务的同一帐户登录的子进程似乎可以正常工作。其他帐户仍然失败。

所有域帐户都可以作为服务登录。

是否有限制帐户Windows服务可以创建子进程吗？我是否只能使用与服务本身相同的帐户创建子进程？

解决方案

确定。我现在得到了错误。下面是我尝试调用`Process.Start`时得到的错误...

System.ComponentModel.Win32Exception（0x80004005）：访问被拒绝

  ;   at System.Diagnostics.Process.StartWithCreateProcess（ProcessStartInfo startInfo）

    at System.Diagnostics.Process.Start（）

    at System.Diagnostics.Process.Start（ProcessStartInfo startInfo）

    at Agent.Runtime.RuntimeBusinessLogic.ExecuteHandler（SupportedHandlerPool handler，AgentTask task）

Hi folks,

I've got C# console application that does one thing - fetch a row from a SQL database and then attempts to spawn a child process. The child process will attempt to use one of several hard-coded domain accounts - whichever account is not currently being used.

My application is written using Topshelf, a Windows service library from Nuget.

When I run my application directly, not as a service, everything seems to work as expected. My application runs, fetches the SQL data and spawns child processes all signing into their appropriate domain accounts.

When I run the application as a service, things don't seem to go as planned. If the service is signed in as a local service, or using the "SYSTEM" account, then the child processes seem to fail completely. I'm not quite sure what the error is, yet. If the service is signed in as one of the previously mentioned domain accounts, it can spawn a child process but only the child process that signs in using the same account that the service is running as seems to work. The other accounts continue to fail.

All of the domain accounts has the ability to sign in as a service.

Is there a restriction on which accounts a Windows service can create child processes as? Can I only create a child process using the same account as the service itself?

解决方案

OK. I've got the error now. Below is the error I get when trying to call `Process.Start` ...

System.ComponentModel.Win32Exception (0x80004005): Access is denied
   at System.Diagnostics.Process.StartWithCreateProcess(ProcessStartInfo startInfo)
   at System.Diagnostics.Process.Start()
   at System.Diagnostics.Process.Start(ProcessStartInfo startInfo)
   at Agent.Runtime.RuntimeBusinessLogic.ExecuteHandler(SupportedHandlerPool handler, AgentTask task)

这篇关于Windows服务应用程序是否可以创建一个子进程，该进程以该服务运行的帐户以外的帐户登录？的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！