How to start/stop windows service on a remote machine?

[Goran Djuranovic]

Hi all,
I have a web app running on a local PC that can start and stop windows service on a remote machine, but only when I browse to it locally. If I browse to it from my other PC and try to start/stop the service, it gives me "Cannot open Service Control Manager on computer 'xxx.xxx.xxx.xxx'. This operation might require other privileges." error.

Helpfull info:
- I am an admin on all 3 PCs
- web app is using "Windows" authentication (Integ. Win. Auth. turned ON in IIS, Anonimous Auth. turned OFF), plus "impersonation"
*** from web.config ***:
<authentication mode="Windows" /
<identity impersonate="true" />
<authorization>
<allow users="*" />
<deny users="?" />
</authorization>

Now, I can make it work, if I add user name and password to impersonation part:
<identity impersonate="true" userName="xxxx" password="xxxx" />
but I need the app to impersonate multiple people (admins), and not one person.

Also, when I don't provide userName and password, event viewer one a remote machine logs "ANONIMOUS LOGON" entry, but when I do provide userName and password the event viewer logs "<MyDomainUser>" entry. All is entered under "Security" log file.

I triple checked my IIS settings, and they see to be fine. What am I doing wrong?

Thanks
Goran

[bruce barker]

window authentication does not allow credentials forwarding. you need to
switch to basic or kerberos and in the case of kerberos enable
forwarding on the servers.

-- bruce (sqlwork.com)
Goran Djuranovic wrote:

Hi all,
I have a web app running on a local PC that can start and stop windows
service on a remote machine, but only when I browse to it locally. If I
browse to it from my other PC and try to start/stop the service, it
gives me "Cannot open Service Control Manager on computer
'xxx.xxx.xxx.xxx'. This operation might require other privileges." error.

Helpfull info:
- I am an admin on all 3 PCs
- web app is using "Windows" authentication (Integ. Win. Auth. turned ON
in IIS, Anonimous Auth. turned OFF), plus "impersonation"
*** from web.config ***:
<authentication mode="Windows" />
<identity impersonate="true" />
<authorization>
<allow users="*" />
<deny users="?" />
</authorization>

Now, I can make it work, if I add user name and password to
impersonation part:
<identity impersonate="true" userName="xxxx" password="xxxx" />
but I need the app to impersonate multiple people (admins), and not one
person.

Also, when I don't provide userName and password, event viewer one a
remote machine logs "ANONIMOUS LOGON" entry, but when I do provide
userName and password the event viewer logs "<MyDomainUser>" entry. All
is entered under "Security" log file.

I triple checked my IIS settings, and they see to be fine. What am I
doing wrong?

Thanks
Goran

[Steven Cheng[MSFT]]

Hello Goran,

I've also found your another cross thread in the
microsoft.public.dotnet.framework.aspnet.security newsgroup. This is a
typical double hop issue of windows authentication. I have posted some
information and suggestion in that thread. Please feel free to followup
there if there is anything else we can help.

Sincerely,

Steven Cheng

Microsoft MSDN Online Support Lead
This posting is provided "AS IS" with no warranties, and confers no rights.

[Goran Djuranovic]

Thanks guys. I have posted some additional questions on cross thread in the
"microsoft.public.dotnet.framework.aspnet.security " group.

Goran Djuranovic

"Steven Cheng[MSFT]" <st*****@online.microsoft.comwrote in message
news:1y**************@TK2MSFTNGHUB02.phx.gbl...

Hello Goran,

I've also found your another cross thread in the
microsoft.public.dotnet.framework.aspnet.security newsgroup. This is a
typical double hop issue of windows authentication. I have posted some
information and suggestion in that thread. Please feel free to followup
there if there is anything else we can help.

Sincerely,

Steven Cheng

Microsoft MSDN Online Support Lead
This posting is provided "AS IS" with no warranties, and confers no
rights.