How do I install a service for a custom user?

Answer

The Java Service Tutorial explains how to install a service under the Local System Account. However, if you want to install a service for a specific user, you need to make sure that this user has enough privileges to install and start system services.

In order to be able to install system services, the user for which you install the service must be an Administrator. Also, this user must be able to log on as a service (a policy must be set for him).

Install a service for an existing user

You can configure a service installation for a custom user which is present on the target machine by following these steps:

• open the AIP resulted after the Java Service Tutorial or an AIP which successfully installs a service
• go to the Install Parameters page and create these properties: SERVICE_USER and SERVICE_PASSWORD
• set the values of these properties to the default username and password of the service (for example User and password)

You can modify these properties throughout the installation (for example by using editboxes on a custom dialog).

• go to the Services page and select your service
• in the Service Properties page set the "User Name" field to .\[SERVICE_USER] and the "Password" field to [SERVICE_PASSWORD]
• make sure that you have the ntrights.exe file on your machine (this file is included in the Windows Server 2003 Resource Kit Tools)
• go to the Custom Actions page and add the "ntrights.exe" file as an Attached custom action under the InstallExecuteSequence -> InstallFiles standard action (you can see a standard action by using the "Show Standard Action" button on the toolbar)
• set the Command Line field to:

-u [SERVICE_USER] +r SeServiceLogonRight

• set the custom action as Immediate

The "ntrights.exe" file will set a policy for the "[SERVICE_USER]" user which will allow him to log on as a service (install and start system services). If you want to revoke this privilege, you can create another custom action under the "InstallExecuteSequence" -> "Uninstall" standard action. This custom action will be configured like the previous one, except it will use this command line:

-u [SERVICE_USER] -r SeServiceLogonRight

The custom action which sets the policy for the user must be conditioned with (Not Installed) and the custom action which removed the policy must be conditioned with REMOVE="ALL".

You can verify if an user can log on as a service by using the "Local Security Policy" tool:

Control Panel -> Administrative Tools -> Local Security Policy\Local Policies\User Rights Assignment\Log on as a service 

Install a service for an user created by your installation package

Windows Installer cannot install a service for an user which is created by the same package which installs the service. Therefore, if you want to install a service for an user you create, you can follow these steps:

• after you configured the project which installs the service for your custom user, create a new Advanced Installer Enterprise project
• in this new project use the Users and Groups page to configure your custom user
• in the Registry page create a registry value which contains the name of your user (this registry entry will be used to determine if the package which creates the user was installed)
• save and build this project
• add the resulted MSI package as a prerequisite for the package which installs the service
• use the registry value in the package which creates the user as the install condition of the prerequisite

When using this approach, the prerequisite package will create your custom user. After its installation is finished, the main package will install the service for this custom user.