Problem when running Windows Service in Local System account

[=?Utf-8?B?cnZhbmdlbGRyb3A=?=]

Hello,

I have a problem with our OnlineBackupService.exe. This is a Windows Service
which is built in .Net 1.1 and basically grabs files from the file system and
will try to upload them using WebServices.

The service is installed by default using LocalSystem account. The exact
problem is that sometimes this service is not allowed to resolve the target
webservice. This results in the following exception:

Could not resolve remote DNS or hostname.

It seems in some cases that the LocalSystem account can not use
internet-based webservices, but not always. I would like to know:
1. How I can make sure that the LocalSystem account can access a webservice
2. If there is an alternative approach to this problem, in which I
accomplish to be able to access the complete file system and upload this to a
webservice.

Thanks ahead,

rvangeldrop

[Jesse Houwing]

* rvangeldrop wrote, On 30-7-2007 11:06:

Hello,

I have a problem with our OnlineBackupService.exe. This is a Windows Service
which is built in .Net 1.1 and basically grabs files from the file system and
will try to upload them using WebServices.

The service is installed by default using LocalSystem account. The exact
problem is that sometimes this service is not allowed to resolve the target
webservice. This results in the following exception:

Could not resolve remote DNS or hostname.

It seems in some cases that the LocalSystem account can not use
internet-based webservices, but not always. I would like to know:
1. How I can make sure that the LocalSystem account can access a webservice
2. If there is an alternative approach to this problem, in which I
accomplish to be able to access the complete file system and upload this to a
webservice.

This almost definitely not an issue with user rights. The fact that it
cannot find or resolve the hostname for the webservice indicates a
network/infrastructure problem. It can be that the connection is down, a
firewall is playing tricks or the DNS server is not responding (or
cannot resolve the hostname because it cannot reach the DNS server that
is hosting the domain name).

You could try if the problem goes away if you connect to the webservice
on its IP address instead of it's fqn.

There is another possible cause: When the system tries to leave too many
connections half-open, windows will temporarily deny new outbound
connections. This will result in an event in the eventlog with Event ID
4226. Though this is a long shot.

Jesse

[=?Utf-8?B?cnZhbmdlbGRyb3A=?=]

Hello Jesse,

If it is not a matter of rights and security, how would you explain the
following:

- If I change the Windows Service the run as a local administrator
everything works fine
-If I change back to let the Windows Service run as LocalSystem the problem
reappears

Somehow the local administrator can resolve a hostname which the LocalSystem
can not?
"rvangeldrop" wrote:

Hello,

I have a problem with our OnlineBackupService.exe. This is a Windows Service
which is built in .Net 1.1 and basically grabs files from the file system and
will try to upload them using WebServices.

The service is installed by default using LocalSystem account. The exact
problem is that sometimes this service is not allowed to resolve the target
webservice. This results in the following exception:

Could not resolve remote DNS or hostname.

It seems in some cases that the LocalSystem account can not use
internet-based webservices, but not always. I would like to know:
1. How I can make sure that the LocalSystem account can access a webservice
2. If there is an alternative approach to this problem, in which I
accomplish to be able to access the complete file system and upload this to a
webservice.

Thanks ahead,

rvangeldrop

[Jesse Houwing]

* rvangeldrop wrote, On 30-7-2007 12:10:

Hello Jesse,

If it is not a matter of rights and security, how would you explain the
following:

The keyword is in ...sometimes... in your original post. If it was
security the service would *never* resolve the hostname. But it most of
the times does, indicating a different cause. Can you reproduce the
error on other systems as well? Have you tried running under a different
user than LocalSystem (which is about the highest there is). Have you
tried with Anti-Virus disabled or if there is an application firewall,
try disabling that. It could be that some worm prevention could mistake
your service for a worm. (I've seen McAfee do this several times before).

Jesse

>
- If I change the Windows Service the run as a local administrator
everything works fine
-If I change back to let the Windows Service run as LocalSystem the problem
reappears

Somehow the local administrator can resolve a hostname which the LocalSystem
can not?
"rvangeldrop" wrote:

>Hello,

I have a problem with our OnlineBackupService.exe. This is a Windows Service
which is built in .Net 1.1 and basically grabs files from the file system and
will try to upload them using WebServices.

The service is installed by default using LocalSystem account. The exact
problem is that sometimes this service is not allowed to resolve the target
webservice. This results in the following exception:

Could not resolve remote DNS or hostname.

It seems in some cases that the LocalSystem account can not use
internet-based webservices, but not always. I would like to know:
1. How I can make sure that the LocalSystem account can access a webservice
2. If there is an alternative approach to this problem, in which I
accomplish to be able to access the complete file system and upload this to a
webservice.

Thanks ahead,

rvangeldrop

[=?Utf-8?B?cnZhbmdlbGRyb3A=?=]

Hello Jesse,

Following up on your mail:
sometimes: means 'on some systems'. The behaviour on a system that is
showing this problem is very consistent. It will never work when running
OnlineBackupService.exe as LocalSystem. Also, changing this to a local
Administrator always resolved the problem.

Your remark about a firewall or anti-virus engine blocking access might be
plausible too, but how does this software distinct its behaviour on the
user-context processes are running in?

I was also thinking of other causes:
- Local security settings are overruled by tighter domain security settings?
- Some LocalSystem profiles miss a certain flag allowing them to resolve
domain names?

Kind regards,

rvangeldrop

"Jesse Houwing" wrote:

* rvangeldrop wrote, On 30-7-2007 12:10:

Hello Jesse,

If it is not a matter of rights and security, how would you explain the
following:

The keyword is in ...sometimes... in your original post. If it was
security the service would *never* resolve the hostname. But it most of
the times does, indicating a different cause. Can you reproduce the
error on other systems as well? Have you tried running under a different
user than LocalSystem (which is about the highest there is). Have you
tried with Anti-Virus disabled or if there is an application firewall,
try disabling that. It could be that some worm prevention could mistake
your service for a worm. (I've seen McAfee do this several times before).

Jesse

- If I change the Windows Service the run as a local administrator
everything works fine
-If I change back to let the Windows Service run as LocalSystem the problem
reappears

Somehow the local administrator can resolve a hostname which the LocalSystem
can not?
"rvangeldrop" wrote:

Hello,

I have a problem with our OnlineBackupService.exe. This is a Windows Service
which is built in .Net 1.1 and basically grabs files from the file system and
will try to upload them using WebServices.

The service is installed by default using LocalSystem account. The exact
problem is that sometimes this service is not allowed to resolve the target
webservice. This results in the following exception:

Could not resolve remote DNS or hostname.

It seems in some cases that the LocalSystem account can not use
internet-based webservices, but not always. I would like to know:
1. How I can make sure that the LocalSystem account can access a webservice
2. If there is an alternative approach to this problem, in which I
accomplish to be able to access the complete file system and upload this to a
webservice.

Thanks ahead,

rvangeldrop

[Jesse Houwing]

* rvangeldrop wrote, On 30-7-2007 14:20:

Hello Jesse,

Following up on your mail:
sometimes: means 'on some systems'. The behaviour on a system that is
showing this problem is very consistent. It will never work when running
OnlineBackupService.exe as LocalSystem. Also, changing this to a local
Administrator always resolved the problem.

Ahh ok ,that is more clear. What's the difference between those systems
is what you'd be looking for.

A clear view on the different user accounts and their security privs can
be located here:

Your remark about a firewall or anti-virus engine blocking access might be
plausible too, but how does this software distinct its behaviour on the
user-context processes are running in?

Some do.

I was also thinking of other causes:
- Local security settings are overruled by tighter domain security settings?
- Some LocalSystem profiles miss a certain flag allowing them to resolve
domain names?

Kind regards,

rvangeldrop

"Jesse Houwing" wrote:

>* rvangeldrop wrote, On 30-7-2007 12:10:

>>Hello Jesse,

If it is not a matter of rights and security, how would you explain the
following:

The keyword is in ...sometimes... in your original post. If it was
security the service would *never* resolve the hostname. But it most of
the times does, indicating a different cause. Can you reproduce the
error on other systems as well? Have you tried running under a different
user than LocalSystem (which is about the highest there is). Have you
tried with Anti-Virus disabled or if there is an application firewall,
try disabling that. It could be that some worm prevention could mistake
your service for a worm. (I've seen McAfee do this several times before).

Jesse

>>- If I change the Windows Service the run as a local administrator
everything works fine
-If I change back to let the Windows Service run as LocalSystem the problem
reappears

Somehow the local administrator can resolve a hostname which the LocalSystem
can not?
"rvangeldrop" wrote:

Hello,

I have a problem with our OnlineBackupService.exe. This is a Windows Service
which is built in .Net 1.1 and basically grabs files from the file system and
will try to upload them using WebServices.

The service is installed by default using LocalSystem account. The exact
problem is that sometimes this service is not allowed to resolve the target
webservice. This results in the following exception:

Could not resolve remote DNS or hostname.

It seems in some cases that the LocalSystem account can not use
internet-based webservices, but not always. I would like to know:
1. How I can make sure that the LocalSystem account can access a webservice
2. If there is an alternative approach to this problem, in which I
accomplish to be able to access the complete file system and upload this to a
webservice.

Thanks ahead,

rvangeldrop