Microsoft KB Archive/327545

= How To Troubleshoot Service Startup Permissions in Windows Server 2003 =

Article ID: 327545

Article Last Modified on 12/3/2007

-

APPLIES TO


 * Microsoft Windows Server 2003, Datacenter Edition (32-bit x86)
 * Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)
 * Microsoft Windows Server 2003, Standard Edition (32-bit x86)
 * Microsoft Windows Small Business Server 2003 Standard Edition
 * Microsoft Windows Small Business Server 2003 Premium Edition

-



This article was previously published under Q327545



IN THIS TASK
SUMMARY Configure User Rights
 * Domain Controller
 * Member Server

Configure Service Logon Information Configure the Service to Start Up with the Built-in System Account



SUMMARY
This article describes how to troubleshoot Service Startup permissions in a Windows Server 2003 environment.

NOTE: The following procedures were documented by a member of the administrators group on a system running Windows Server 2003, Enterprise Edition.

If a service does not start because of a logon failure, an error message similar to one of the following may be generated and displayed in the system event log:  

Source: Service Control Manager

Event ID: 7000

Description:

The %service% service failed to start due to the following error:

The service did not start due to a logon failure.

No Data will be available.

 

Source: Service Control Manager

Event ID: 7013

Description:

Logon attempt with current password failed with the following error:

Logon failure: unknown user name or bad password.

No Data will be available.



This behavior may occur if one or more of the following conditions are true:
 * The password is changed on the account with which the service is configured to log on.
 * The password data in the registry is damaged.
 * The right to log on as a service is revoked for the specified user account.

To resolve these issues, configure the service to use the built-in system account, change the password for the specified user account to match the current password for that user, or restore the user's right to log on as a service. These methods are described in the following sections of this article.

back to the top

Configure User Rights
If the right to log on as a service is revoked for the specified user account, restore that right on either a domain controller or a stand-alone member server, as appropriate to your circumstances.

Domain Controller
If the user is in an Active Directory domain, follow these steps:
 * 1) Click Start, point to, Administrative Tools, and then click Active Directory Users and Computers.
 * 2) In the console tree, right-click the organizational unit in which the user right to log on as a service was granted. By default, this is in the Domain Controllers organizational unit.
 * 3) Right-click the container that you want, and then click Properties.
 * 4) On the Group Policy tab, click Default Domain Controllers Policy, and then click Edit.

This starts Group Policy Manager.
 * 1) Expand Computer Configuration, expand Windows Settings, and then expand Security Settings.
 * 2) Expand Local Policies, and then click User Rights Assignment.
 * 3) In the right pane, right-click Log on as a service, and then click Add User or Group.
 * 4) In the User and Group Names box, type the name that you want to add to the policy, and then click OK.
 * 5) Quit Group Policy Manager, close Group Policy properties, and then quit the Active Directory Users and Computers Microsoft Management Console (MMC) snap-in.

back to the top

Member Server
If the user is a member of a stand-alone member server, follow these steps:
 * 1) Start the Local Security Settings MMC snap-in.
 * 2) Expand Local Policies, and then click User Rights Assignment.
 * 3) In the right pane, right-click Log on as a service, and then click Add User or Group.
 * 4) In the User and Group Names box, type the name that you want to add to the policy, and then click OK.
 * 5) Quit the Local Security Settings MMC snap-in.

back to the top

Configure Service Logon Information
Configure the password for the specified user account to match the current password for that user. To do this, follow these steps:
 * 1) Click Start, point to Administrative Tools, and then click Services.
 * 2) Right-click the service that you want, and then click Properties.
 * 3) Click the Log On tab, change the password, and then click Apply.
 * 4) Click the General tab, and then click Start to restart the service.
 * 5) Click OK, and then close the Services tool.

back to the top

Configure the Service to Start Up with the Built-in System Account
If the service still does not work with the specified user account, you can configure the service to start up with the built-in system account. To do this, follow these steps:  Click Start, point to Administrative Tools, and then click Services. Right-click the service that you want, and then click Properties. Click the Log On tab, click Local System Account, and then click Apply.NOTE: You typically do not have to configure a service to interact with the desktop, and therefore you do not have to select the Allow service to interact with desktop check box.

 Click the General tab, and then click Start to restart the service.</li> Close the Services tool. When you try to open the properties of a service by using the Services tool in Control Panel, the computer may stop responding, and then you may receive the following error message:

The RPC Server is unavailable.

This issue may occur if the remote procedure call (RPC) service is not started because of a logon failure with that service or a dependency service. Some services have dependency services that do not start until their dependency services start first (for example, the Workstation service).</li></ol>

back to the top

Keywords: kbmgmtservices kbsecurity kberrmsg kbhowtomaster KB327545

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.