NetworkService account does not start service in German OS

[garosgu]

Hello,

Regarding this user guide about how to run a service under NetworkService account.

English OS can run the service but when I try with the same project application in a German OS does not work.

English OS

networkservice_english_os.png (2.52 KiB) Viewed 3330 times

German OS

networkservice_german_os.png (3.01 KiB) Viewed 3330 times

In this case, if I want to run the service, I have to set manually Netzwerkdienst account, and the service window shows the same user in the previous image (German OS) but without the domain (NT-AUTORITÄT).

NOTE: I get NetworkService account name from S-1-5-20 (Well-known SIDs).

AI version: 16.0

Kind regards.

[Catalin]

Hello,

NOTE: I get NetworkService account name from S-1-5-20 (Well-known SIDs).

Could you please give me some more details as to how you are retrieving the name of the account?

Is it through a Custom Action? If so, on the German machine, isn't the name retrieved localized (i.e. "Netzwerkdienst" instead of "Network Service")?

Best regards,
Catalin

[garosgu]

Hello Catalin,

I am getting the name of the account from a custom action with the following visual basic script:

Code: Select all

Set objWMI = GetObject ("winmgmts:root\cimv2")
Set objSid = objWMI.Get ("Win32_SID.SID='S-1-5-20'")

Session.Property("NetworkServiceDomain") = objSid.ReferencedDomainName
Session.Property("NetworkServiceName") = objSid.AccountName

The problem is when I try to log on as a service with the feature of AI software as you can see in the screenshot:

ai_log_on_as_a_service.png (3.66 KiB) Viewed 3288 times

On English machines, the service is running with the name Network Service like the first post of this topic and it works successfully but on German machines, the service is running with the name NT-AUTORITÄT\Netzwerkdienst and it does not work, if I want that the service works, I have to set manually the name Netzwerkdienst without the domain like on the English machine to be able to run the service and I am using the same setup for both OS languages (English and German).

Kind regards.

[Catalin]

Hello,

First of all, please accept my apologies for the delayed reply.

I have an English machine on which I have downloaded the "Deutsch (Deutschlan)" language pack and installed it & set it as default.

I have then ran a a test on it and everything seemed to be working as expected - the service was started under the "Netzwerkdienst" account, which is the display name for the "NT-AUTORITÄT\Netzwerkdienst" account.

I'd say that in this case it might be something related to the machine where the setup is ran.

Best regards,
Catalin

[garosgu]

Hello Catalin,

I am using a new virtual machine (new installation) with the German language as default. I do not know if there is some difference between installing Windows with German as default or Windows with English as default but then install the German language pack.

Kind regards.

[Catalin]

Hello,

I've now created a new Virtual Machine with the German language as default and I was indeed able to replicate the behavior.

After some hours of investigating this, I actually found out that this is the normal behavior. This can be seen in the "NetworkService Account" article from Microsoft.

In the above article, it states that:

While the security subsystem localizes this account name, the SCM does not support localized names. Therefore, you will receive a localized name for this account from the LookupAccountSid function, but the name of the account must be NT AUTHORITY\NetworkService when you call CreateService or ChangeServiceConfig, regardless of the locale, or unexpected results can occur.

If you run your script manually on the machine with the German language as its' default, you will notice that it returns the name of the account localized.

Code: Select all

Set objWMI = GetObject ("winmgmts:root\cimv2")
Set objSid = objWMI.Get ("Win32_SID.SID='S-1-5-20'")

MsgBox objSid.ReferencedDomainName
MsgBox objSid.AccountName

This is the reason why this has worked on my previous test machine (where I have downloaded the language pack), because the script was returning the account name non-localized, despite the fact that I had the language pack installed.

Therefore, the solution to this would be to follow the article and simply input the "NT AUTHORITY\NetworkService" account in the "User" field. I have tested this and the service was started correctly.

Hope this helps!

Best regards,
Catalin