在网络服务帐户下访问 Windows 共享
我有两台装有 Windows Server 2003 的计算机。一台计算机在网络上有一些共享文件夹，另一台计算机有一个需要访问这些共享文件夹的 Windows 服务（用 C# 编写，在 Network Service 帐户下运行）。
以下代码作为登录用户可以正常工作，但在网络服务帐户下执行时会引发异常。
File.WriteAllText(@"C:\temp\temp.txt", File.ReadAllLines(@"\\NetworkServer\Test\test.txt")[0]);
异常消息为登录失败：未知的用户名或错误密码。如何让此代码在网络服务帐户下工作？这是 Windows Server 2003 中的设置，还是我需要添加一些代码才能使其工作？
I have two computers with Windows Server 2003. One computer has some shared folders on the network, and the other has a Windows Service (written in C#, running under the Network Service account) that needs to access those shared folders.
The following code works fine as a logged-in user, but throws an exception when executed under the Network Service account.
File.WriteAllText(@"C:\temp\temp.txt", File.ReadAllLines(@"\\NetworkServer\Test\test.txt")[0]);
The exception message is Logon failure: unknown user name or bad password. How do I get this code to work under the Network Service account? Is it a setting in Windows Server 2003, or do I need to add some code to this to make it work?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
据我所知，@Nate 的答案要么不正确，要么不清楚。它没有解释
Network Service如何在网络上进行身份验证。网络服务帐户在本地系统上的权限非常有限，它在网络上提供计算机的凭据。因此，如果您需要访问网络服务帐户下的网络资源（例如网络共享），您必须向该服务所在的计算机帐户授予访问权限。提供本地
网络服务帐户来访问网络资源根本不起作用，您将不断收到身份验证/授权错误。请参阅 MDSN“网络服务帐户”参考。
@Nate's answer is either incorrect or is unclear, as far as I can tell. It doesn't explain how
Network Serviceauthenticates on the network.Network Serviceaccount has very limited privileges on a local system, it presents the computers's credentials on the network. So if you need to access a network resource (e.g. a network share) underNetwork Serviceaccount, you have to grant access to the computer's account where the service works.Providing local
Network Serviceaccount with access to a network resource won't work at all, you'll keep getting authentication / authorization errors.See MDSN "NetworkService Account" reference.
在网络共享上，您需要为运行该服务的服务器上的“网络服务”帐户添加权限。虽然这可行，但 @nicholas 指出，这可能会为过于广泛的用户群体提供对共享的访问权限。
另一种选择（在我看来更好的选择）是创建一个域帐户，然后授予该帐户对共享的读/写权限。然后，您将服务配置为“以”具有适当权限的域帐户“运行”。
On the network share, you'll need to add permissions for the "Network Service" account on the server running the service. While this will work, @nicholas points out that this may provide an overly broad group of users access to the share.
Another option, and in my opinion the better option, is to create a domain account and then give that account read/write permission on the share. Then you configure the service to "run as" the domain account with proper permissions.
当网络服务帐户尝试访问远程服务器上的共享时，它会使用计算机帐户在网络上进行身份验证。授予权限时，此帐户将以 $ 为后缀（如
servername$）。当网络服务帐户尝试访问托管在同一服务器上的共享时，计算机帐户将无法授予网络服务访问权限。在这种情况下，网络服务内置帐户需要被授予对文件系统位置和共享权限的访问权限。
基本上，当您授予网络服务对共享的访问权限时，它只会影响在本地计算机上以该身份运行的服务。对于远程计算机，必须使用计算机帐户，并且计算机帐户不能用于向网络服务授予对本地资源的访问权限。
When the Network Service account attempts to access a share on a remote server, it authenticates on the network using the computer account. This account will be suffixed with $ (like
servername$) when granted permission.When the Network Service account attempts to access a share hosted on the SAME SERVER AS ITSELF, the computer account will NOT be able to grant the network service access. In this event, the Network Service built-in account will need to be granted access BOTH to the filesystem location AND the share permissions.
Basically, when you grant Network Service access to a share, it only will affect services running as that identity on the local machine. For remote machines, the computer account must be used, and the computer account cannot be used for granting access to local resources to Network Service.