none
Ever have a service fail to start with Local System, but will start with anything else? RRS feed

  • Question

  • I've got a service that starts on my development box (win 10 home) under local system, but a particular Win 10 Pro box has this odd behavior:  The service will fail immediately with erro 1053: The service did not respond to the start or control request in a timely fashion.  This is an immediate error when I click start if it is configured for local system.  Not a typical few second delay where the OS waits for a service to respond.  If I change it to any named user for the logon such as administrator or a test user I created with regular user rights, it starts right up.  If I change it to local service, it starts right up.  I thought maybe some policy on the system was changed or something, but there are lots of other 3rd party services like an Adobe updater that are configured for local system and are started.  I then made an empty service that essentially does nothing but respond to service requests thinking maybe there was some odd dependency, but even the empty service can't start using local system.  Any ideas?
    Monday, June 29, 2020 9:10 PM

All replies

  • Put some logging into your service to determine where it is failing: service process start, service start, etc.

    Also make sure you aren't making any network calls as these fail with local system. Might also add some unhandled exception logging and look at the Windows event log for any system error details that might reveal what is going on.


    Michael Taylor http://www.michaeltaylorp3.net

    Monday, June 29, 2020 9:57 PM
    Moderator
  • Thanks Michael - I made up some test applications.  There is something about the executable it does not like - it is a Borland/Embarcadero cppbuilder service application.  I tried 3 things - a really old version of cppbuilder (v6), a modern version (RAD studio 10.3), and a VS2017 service project.  All were very much empty new skeleton projects.  The VS2017 project works fine under local system, but the other two (both old and new do not).  I would assume that there is something wrong going on once the code is started, but there is something about the executable that it does not like - it never executes it as local system.  I added a logging function to it that gets called immediately after winmain:

    void output(char *s)
    {
      FILE *file;
    
      file=fopen("c:\\1\\test.txt","a+");
      if (file!=NULL)
        {
          fprintf(file,"%s\n",s);
          fclose(file);
        }
    }
    
    int WINAPI _tWinMain(HINSTANCE, HINSTANCE, LPTSTR, int)
    {
      output("winmain");
    
    If I start this with local system, it will never execute the output("winmain") line.  It immediately fails.  If I change it to another user, it will work as expected.  Is there some flag that would make a difference in the EXE header for whether it was configured as localsystem vs. some other account?  If I set it to run as local service or any named user, it will work, but not as localsystem.
    Tuesday, June 30, 2020 12:47 PM
  • Well, winmain sounds like your service interacts with the desktop. Services running under LocalSystem should never interact.

    And for your problem, check whether you've correctly setup/installed your service for desktop interaction.

    Tuesday, June 30, 2020 12:55 PM
  • This is a C# only forum so we're going to be limited on the C++ help we can give.

    There is no difference between a service and regular app EXE as far as Windows is concerned. They are the same. In fact a service process can often be run as either a console app or a service. It makes testing easier. But it is important to note that it needs to be a console app, not a Windows app.

    In your code you are defining a Window entry point. That isn't how a service works. Services have a normal console entry point. Why does this not work for SYSTEM? I have no idea but it could be related to how a Windows app starts up. Nevertheless change the Winmain to a normal main. This should allow the process to start. You then need a service entry point for each service. This is what the SCM calls. Refer to this older documentation on an example service. Then test your SYSTEM issue.


    Michael Taylor http://www.michaeltaylorp3.net

    Tuesday, June 30, 2020 12:56 PM
    Moderator
  • I appreciate the help you guys are giving!  Borland/Embarcadero have used this model for a long time (v6 goes back to 2002) and it also creates a skeleton service application project with winmain.  They have code and a class built around it so I'm not sure I can change it (though I could try.)

    Enabling the "allow service to interact with desktop" doesn't change the issue at all, it still fails the same.  It also works under localsystem on my development box (win10 home), just not on this lab system (win 10 pro).  It is unknown if it works on other win 10 pro systems or not or if the OS update level has anything to do with it.

    Do you guys know of/recommend a PE viewer that I can use to look at the output?

    Tuesday, June 30, 2020 1:23 PM
  • In your code you are defining a Window entry point. That isn't how a service works. Services have a normal console entry point.

    This is a bit of a misstatement.  A windows service can have WinMain as an entry point as long as it provides the other required functions for a service (e.g., ServiceMain, etc.).  In fact, the Visual C++ ATL template to create a Windows service uses WinMain.
    Tuesday, June 30, 2020 1:30 PM
  • Another developer on my team has seen this issue with a .NET 4.5 C# application as well.
    Tuesday, June 30, 2020 1:34 PM
  • This really doesn't appear to be related to C# which is what this forum is for. Since you are having an issue with a third party product I'll recommend you post in their forums or simply use C# instead. We can provide support for C#.



    Michael Taylor http://www.michaeltaylorp3.net

    Tuesday, June 30, 2020 1:41 PM
    Moderator
  • I do have someone reporting the same problem for C#.

    The event log shows two events, 7000 and 7009.  Oddly 7009 goes on about how it has been 30 seconds without a response, but that is false.  It fails immediately.  The windows version is 10.0.18363.900.

    Tuesday, June 30, 2020 1:45 PM
  • I doubt these are the same issues. Let's focus on the C# problem. Please post the relevant start code. The error indicates the service has responded to the SCM in a manner that the SCM thinks is an error. This is generally caused by bad OnStart code.

    Does the service run at all or just not under SYSTEM? If it doesn't run at all then it is a problem with OnStart or one of the static objects that are being loaded. If it works but not for SYSTEM then I'd lean toward a network call early on that gets blocked. Posting the relevant code would be beneficial.


    Michael Taylor http://www.michaeltaylorp3.net

    Tuesday, June 30, 2020 1:55 PM
    Moderator
  • I'm trying to get the details from him on the C# code now.  It might not be the same issue if it starts for him under localsystem but just doesn't have the rights it needs.
    Tuesday, June 30, 2020 2:11 PM
  • Indeed the C# issue is not the same.  I'll keep at it, thanks for the help guys.
    Tuesday, June 30, 2020 3:29 PM