由使用本地系统帐户的 Windows 服务启动的可执行文件无法访问网络共享
我有一个由 Windows 服务启动的可执行文件，该程序将在客户计算机上运行，并且需要连接到远程共享才能执行特定任务。 该共享由客户通过 UI 指定，因此我们事先不知道这一点，这意味着它不能“硬编码”，也不能提前映射共享。
以前我们要求客户登录到他们的机器并在登录时运行可执行文件，但我们一直希望允许我们的程序在服务中运行而不需要登录，主要是为了让客户更容易并防止任何意外注销而关闭我们的软件。 因此，这也意味着我们不知道客户计算机上存在哪些本地用户帐户，因此我们必须使用本地系统帐户启动服务。
如上所述，我们现在有一个包装器服务来启动可执行文件并执行各种任务。 这在大多数情况下似乎工作正常，并且可以很好地访问底层网络 - 我们软件的目的主要涉及捕获数据包等。
但是，当软件尝试连接到 Windows 共享（UNC 名称）时，它无法连接。 而如果可执行文件是手动启动的，则可以正常连接。
我通常看到的解决此类问题的建议似乎都说使用用户帐户，因为系统帐户无法访问网络共享，但在我们的情况下这是不可能的。 我们还有其他方法可以让它发挥作用吗？
编辑：我忘了提到这个应用程序可以（并且最常见的是）在Win2K而不是XP上运行，我认为我说得对，本地网络帐户在XP之前不可用？
I have an executable that is started by a windows service, this program will be run on a customers machine and will need to connect to a remote share to perform a particular task. This share is specified by the customer via a UI, so we do not know this in advance meaning it can't be "hard-coded", or the share mapped in advance.
Previously we required the customer to log on to their machine and run the executable on log-on , but we have always wanted to allow our program to run within a service and not require a log-in, primarily to make it easier for the customer and prevent any accidental log-outs shutting down our software. So this also means we don't know what local user accounts exist on a customers machine, so we have to start the service using the local system account.
We now have, as mentioned above, a wrapper service to start the executable and perform various tasks. This appears to work fine in most cases and accesses the underlying network fine - our software's purpose mainly involves capturing packets etc.
However, when the software tries to connect to a windows share (UNC name) it cannot connect. Whereas if the executable was started manually it connects fine.
The suggestions I have generally seen to resolve these kind of issues appear to all say use a user account as the system account cannot access network shares, but in our case this isn't possible. Is there any other way we could get this to work?
Edit: I forgot to mention that this application could (and most commonly will be) run on Win2K not XP, and I think I'm right in saying that the Local Network account is not available before XP?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
如果您可以更改 Windows 服务，使其在网络服务帐户下运行，那么您的可执行文件将能够访问网络共享（这是创建网络服务帐户的原因之一）。
本地系统和本地服务帐户没有任何网络凭据，因此无法在网络上进行身份验证。 这是设计使然。
编辑： IIRC，网络服务帐户是在 Server 2003 中引入的，并添加到 XP 服务包之一中。
如果您不能依赖可用的网络服务帐户，那么您可能会考虑创建一个专用域帐户，将该帐户的凭据存储在某处，从您的服务内部读取它们，然后在访问网络共享之前登录并模拟该用户。 或者，Windows 服务可以直接作为专用帐户运行，在这种情况下，它将需要“作为服务登录”权限。
If you can change your windows service so that it runs under the Network Service account, then your executable will be able to access network shares (this is one reason why the Network Service account was created).
The Local System and Local Service accounts do not have any network credentials, and thus can't be authenticated on the network. This is by design.
Edit: IIRC, the Network Service account was introduced in Server 2003, and added to one of the XP service packs.
If you cannot rely on the Network Service account being available, then you might consider creating a dedicated domain account, storing the account's credentials somewhere, reading them from inside your service, then loging in and impersonating that user prior to accessing the network share. Alternatively, the windows service could run as the dedicated account directly, in which case it would require the "logon as a service" privilege.
当您的服务在 NT AUTHORITY\LOCALSYSTEM（这是服务帐户的名称）下运行时，它对网络的其余部分显示为 DOMAINNAME\COMPUTERNAME$（注意 $ 符号）帐户。 也就是说，它在 Active Directory 中显示为计算机的帐户。 只需将您的文件和共享权限授予 DOMAINNAME\COMPUTERNAME$ 即可。
When you have a service that runs under NT AUTHORITY\LOCALSYSTEM (which is the name of the service account), it appears as the DOMAINNAME\COMPUTERNAME$ (note the $ sign) account to the rest of the network. That is, it appears as the COMPUTER's account in Active directory. Just grant your file and share permissions to DOMAINNAME\COMPUTERNAME$ and you should be good.
为什么不能使用其他帐户？ Windows 中内置了一个网络服务帐户，专门用于需要网络访问的服务。
无论如何，让服务启动 exe 时要非常小心。
如果未禁用对包含 exe 的文件夹的写访问权限，用户可以使用（例如）
cmd.exe替换该 exe。 下次服务尝试启动您的 exe 时，瞧：具有系统权限的命令 shell！Why can't you use another account? There is a network service account built into Windows, specifically for services that need network access.
Anyway, be very careful when having a service start an exe.
If the write access to the folder with the exe is not disabled, a user can replace that exe with (for example)
cmd.exe. The next time the service tries to start your exe, voilà: A command shell with system rights!