NT Service wont stop / kill gives access denied

Hi,

I have written an NT service that works fine on most machines, but not on a particular Windows Server instance.

When I attempt to stop the service, i get an error saying the service wasn't stopped properly due to an error.

When I attempt to kill the service process manually, I get "access denied", despite beeing Administrator both during install and when trying to kill it (!) The service runs under the Local System account.

The service uses Sybase database client libs and use files and timer, but as I said - it works on "all" machines but one.

Ideas would be greatly appreciated.

Thanks,
sr

Did you try this under Admin user's context ?

Quote:

---

Originally Posted by Krishnaa

Did you try this under Admin user's context ?

---

Yes, that's the reason I'm so puzzled - I would expect the admin user to be able to kill processes. This is all very strange.

You must up your kill app Privilege as a debugger.

Code:

---

EnableDebugPrivilege(BOOL bflag)
{
        HANDLE hProcess;
        HANDLE        hToken;


        hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, GetCurrentProcessId());
        if(hProcess)
        {
                if(OpenProcessToken(hProcess, TOKEN_ADJUST_PRIVILEGES, &hToken))
                {
                        TOKEN_PRIVILEGES tp;

                        tp.PrivilegeCount = 1;
                        LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &tp.Privileges[0].Luid);
                        tp.Privileges[0].Attributes = bflag ? SE_PRIVILEGE_ENABLED : 0;
                        AdjustTokenPrivileges(hToken, FALSE, &tp, sizeof(tp), NULL, NULL);

                        CloseHandle(hToken);
                }
                CloseHandle(hProcess);
        }
}

---

Not sure if I understand, pengch. This is production, release code. The problem has occured on one of many, many machines.

I try to stop/kill the service as an adminstrator user, not programmatically.

Do you think "upping" the priv level in the SERVICE STOP handler will help?

How did you to kill the service? Using taskmanag?

Quote:

---

Originally Posted by wincoder

I have written an NT service that works fine on most machines, but not on a particular Windows Server instance.

When I attempt to stop the service, i get an error saying the service wasn't stopped properly due to an error.

When I attempt to kill the service process manually, I get "access denied", despite beeing Administrator both during install and when trying to kill it (!) The service runs under the Local System account.

---

You definitely must concentrate on the prob in bold. Killing services is very, very, very bad idea.

I go with Igor. Killing is not the ultimate solution. You should be able to stop the service properly.

"You definitely must concentrate on the prob in bold. Killing services is very, very, very bad idea."

Look - the fact that I can't even kill the service was mentioned since it may well be a lead to the real problem. It is obvious that one shouldn't kill services, just like you shouldn't kill other apps unless absolutely necessary.

The question is still: Why on earth can't I kill the service - which is really just another process - when I'm on the administrator account (using the task manager).

May be the local security policy prevents to do that. Try killing other services that run on local system account.

Quote:

---

Originally Posted by wincoder

Look - the fact that I can't even kill the service was mentioned since it may well be a lead to the real problem.

---

Yes, the fact you don't understand why your attempt to kill service had failed indeed may lead to a real problem. :)

Quote:

---

It is obvious that one shouldn't kill services, just like you shouldn't kill other apps unless absolutely necessary.

---

Glad you understand this. It would be one more thing to understand - the service which is prone to be uncontrollable must be run on the problem machine only for developers' sake, and developers must do their best to eliminate the problem asap. And first thing they must to learn is how to actually kill a service process instead of been stuck on their admired Administrator account. :)

Quote:

---

The question is still: Why on earth can't I kill the service - which is really just another process - when I'm on the administrator account (using the task manager).

---

Sorry, but highlighted assertion is false. The service is not just another process - because it's the process running in special window station with restricted access permissions, unless it's not running in "interact with desktop" mode. :)

Unfortunately pengch's message didn't helped in my tests - the debug privilege becomes held but PROCESS_TERMINATE access query is rejected.

I never messed with service murdering, so if I'll have some time to get a solution I'll let you know about the results. :wave:

PS. The most simple way I believe would be a special service process killing a required service process on behalf of user client process. Looks not so elegant, I admit this, but this must do work, I hope. :)

Quote:

---

Originally Posted by Igor Vartanov

Sorry, but highlighted assertion is false. The service is not just another process - because it's the process running in special window station with restricted access permissions, unless it's not running in "interact with desktop" mode.

---

I *am* running in "interact with desktop" mode.

Quote:

---

Originally Posted by Igor Vartanov

Unfortunately pengch's message didn't helped in my tests - the debug privilege becomes held but PROCESS_TERMINATE access query is rejected.

---

I didn't understand why Igor Vartanov so said. I maked a tool name killprocess which used debug privilege can kill service. you can download it form our website.

http://www.autodebug.com/download/processkill.zip

Quote:

---

Originally Posted by pengch

I didn't understand why Igor Vartanov so said. I maked a tool name killprocess which used debug privilege can kill service.

---

Bad news for you, man. Your tool fails to kill services on my Win2003 Server SP1. :)

Quote:

---

Originally Posted by wincoder

I *am* running in "interact with desktop" mode.

---

As I had found out "interact with desktop" helps in no way in service killing. :)