13

I want to set password for a service from the cmd. I got the option

sc.exe config "Service Name" obj= "DOMAIN\User" password= "password"

When I execute, its showing "[SC] ChangeServiceConfig SUCCESS" and if I start the service I am getting

"Windows could not start the service1 service on Local Computer. Error 1069: The service did not start due to a logon failure."

I searched and got the below link Using SC.exe to set service credentials password fails

My password doesn't consist of special character.

What's the option to do that?

Community
  • 1
  • 1
Paul
  • 1,176
  • 3
  • 12
  • 27

4 Answers4

5

The first thing to check is if that user has permission to Log On As A Service in that machine. If he does (and you can do the following procedure to check this), just go to the service (Start Menu - type "services", without the quotes). Find your service on the list, and right-click on it. Select "Properties", and go to the "Log On" tab. Retype the "Password" and "Confirm password". Click OK. If your user DOES have permission to Log On as a Service, a message "The account YourDomain\YourUser has been granted the Log On As a Service right". Just try to start the service again, and it will work.

If your user does not have this kind of permission, you can use one of these two approaches:

1) Start menu - type "local security policy" without the quotes. Open the "Local Policies", then left-click on "User Rights Assignment". On the right panel, right-click on "Log on as a service", and select "Properties". Click on "Add User or Group" and add your user. Click OK. You might have to reboot your machine.

2) Download and install the "Windows Server 2003 Resource Kit Tools" (http://www.microsoft.com/en-us/download/confirmation.aspx?id=17657). Open a command prompt and type:

ntrights +r SeServiceLogonRight -u MyDomain\MyUser -m \\%COMPUTERNAME%

Reboot your computer and try to start the service again.

After your user has been granted the Log On As A Service right, you can create and start services through the command line.

Marcos Arruda
  • 532
  • 7
  • 15
  • After calling ntrights, instead of restarting the computer, calling "gpupdate /force" is also sufficient. I found this useful to create a script that doesn't need restarting. – FourtyTwo Jul 11 '16 at 09:10
  • 1
    This is an old answer but please note that when you enter the password manually using the services.msc windows automatically grant you the permission to log on as a service. So you need to make sure you have the right permissions in a different way.. – DavidDr90 Apr 30 '19 at 06:15
  • FYI I did not have to reboot after doing approach #1. – user276648 Jun 28 '23 at 09:50
3

If you face The account YourDomain\YourUser has been granted the Log On As a Service right, you should execute powershell script link AddLogonasaService and this is nothing to do with your password. It's a right/permission for an user to run the service.

Am embedding the code for your reference. You can refer that URL as well.

param($accountToAdd)
 #written by Ingo Karstein, http://blog.karstein-consulting.com
 #  v1.0, 01/03/2014

 ## <--- Configure here

 if( [string]::IsNullOrEmpty($accountToAdd) ) {
    Write-Host "no account specified"
    exit
 }

 ## ---> End of Config

 $sidstr = $null
 try {
    $ntprincipal = new-object System.Security.Principal.NTAccount "$accountToAdd"
    $sid = $ntprincipal.Translate([System.Security.Principal.SecurityIdentifier])
    $sidstr = $sid.Value.ToString()
 } catch {
    $sidstr = $null
 }

 Write-Host "Account: $($accountToAdd)" -ForegroundColor DarkCyan

 if( [string]::IsNullOrEmpty($sidstr) ) {
    Write-Host "Account not found!" -ForegroundColor Red
    exit -1
 }

 Write-Host "Account SID: $($sidstr)" -ForegroundColor DarkCyan

 $tmp = [System.IO.Path]::GetTempFileName()

 Write-Host "Export current Local Security Policy" -ForegroundColor DarkCyan
 secedit.exe /export /cfg "$($tmp)" 

 $c = Get-Content -Path $tmp 

 $currentSetting = ""

 foreach($s in $c) {
    if( $s -like "SeServiceLogonRight*") {
        $x = $s.split("=",[System.StringSplitOptions]::RemoveEmptyEntries)
        $currentSetting = $x[1].Trim()
    }
 }

 if( $currentSetting -notlike "*$($sidstr)*" ) {
    Write-Host "Modify Setting ""Logon as a Service""" -ForegroundColor DarkCyan

    if( [string]::IsNullOrEmpty($currentSetting) ) {
        $currentSetting = "*$($sidstr)"
    } else {
        $currentSetting = "*$($sidstr),$($currentSetting)"
    }

    Write-Host "$currentSetting"

    $outfile = @"
 [Unicode]
 Unicode=yes
 [Version]
 signature="`$CHICAGO`$"
 Revision=1
 [Privilege Rights]
 SeServiceLogonRight = $($currentSetting)
 "@

    $tmp2 = [System.IO.Path]::GetTempFileName()


    Write-Host "Import new settings to Local Security Policy" -ForegroundColor DarkCyan
    $outfile | Set-Content -Path $tmp2 -Encoding Unicode -Force

    #notepad.exe $tmp2
    Push-Location (Split-Path $tmp2)

    try {
        secedit.exe /configure /db "secedit.sdb" /cfg "$($tmp2)" /areas USER_RIGHTS 
        #write-host "secedit.exe /configure /db ""secedit.sdb"" /cfg ""$($tmp2)"" /areas USER_RIGHTS "
    } finally { 
        Pop-Location
    }
 } else {
    Write-Host "NO ACTIONS REQUIRED! Account already in ""Logon as a Service""" -ForegroundColor DarkCyan
 }

 Write-Host "Done." -ForegroundColor DarkCyan

To set the identity for services, I have used a vbscript

Set colServiceList = objWMIService.ExecQuery _
("Select * from Win32_Service where Name = 'Servicename'")
For Each objservice in colServiceList   
errReturn = objService.Change( , , , , , ,WScript.Arguments.Item(0),   WScript.Arguments.Item(1)) 
objService.StartService()   
Next

Where WScript.Arguments.Item(0) is the username arg and WScript.Arguments.Item(1) is password.

Paul
  • 1,176
  • 3
  • 12
  • 27
  • 2
    There is a newer version of powershell script for granting "Set Logon As A service" right: https://stackoverflow.com/questions/313831/using-powershell-how-do-i-grant-log-on-as-service-to-an-account/21235462#21235462 – Dennis Gorelik Oct 20 '18 at 14:44
1

Probably the issue is that it doesn't want quotes around the password. Same goes for the username.

It perhaps cannot tell whether the quotes are part of the password or not.

Alternatively it may be because the given account has not been granted the "log on as a service" privilege.

Generally you should check the Security event log, which will give the reason for the logon failure.

Ben
  • 34,935
  • 6
  • 74
  • 113
  • I removed the quotes. Still Same issue. – Paul Sep 27 '13 at 15:13
  • @Earnest, does the account have permission to log on as a service? Have you checked the event log? – Ben Sep 27 '13 at 15:14
  • That user is having permission to log on as a service. **Event log** The service1 service failed to start due to the following error: The service did not start due to a logon failure. – Paul Sep 27 '13 at 16:54
  • That's the System event log. What about the Security event log? – Ben Sep 27 '13 at 16:57
  • No log for this action in security event log – Paul Sep 27 '13 at 17:50
  • @Earnest, Then turn on login auditing in the Security policy, then you will see it. – Ben Sep 28 '13 at 13:41
  • 1
    Make sure you are giving the user to "logon as a service" (local policy). – Tosh Jan 07 '14 at 10:50
-1

This worked for me:

sc.exe stop "<my_service>" 4:4:3
sc.exe config "<my_service>" obj= "./<local_acc_name>" password= "<local_acc_pass>"
sc.exe start "<my_service>"

So, in short: stop the service before config the password and the start will work fine.

Prasanth Louis
  • 4,658
  • 2
  • 34
  • 47
user3452718
  • 1