15

I know this question has been asked in the past, but a satisfactory answer has not been provided.

I am using the SC command to config the credentials for a service.

SC.exe config "SERVICE NAME" obj= "domain\user" password= "password"

This completes successfully, but when I start the service, it fails to perform the login.
[NET START "service name"]

If I manually update ONLY the password from the services.msc, then when I start the service it works fine.

I have hundreds of servers to update this change occurs in the middle of a deployment, so manual intervention is NOT an option.

I have tried using the config to update the login account and then another config command for the password.

From all accounts, the SC.exe does not work for passwords and Microsoft has NO help.

IDEAS?

3
  • 1
    Does password contain any special characters, like (,),',",$,>,<,^,?. If so, you might need to escape them.
    – seva titov
    Jan 19, 2013 at 17:42
  • 2
    I was able to use sc.exe to set password many times. You just need to get the password coded righ. Any other special characters besides '@' and '&'? E.g. '%' needs a special treatments: stackoverflow.com/questions/10296162/…
    – seva titov
    Jan 21, 2013 at 21:57
  • Based on this simplified use case, there seems to be an issue. The same issue occurs when using Ansible win_service. I have tried rebooting before trying to reconfigure the logon user, but nothing works. After a service is created with default user... Fails: 1. sc.exe config "myService" obj= "MYDOMAIN\myuser" password= "BAD" 2. sc.exe config "myService" obj= "MYDOMAIN\myuser" password= "<redacted>" Succeeds: 1. Set password to BAD via Windows service UI. (dark magic happening) 2. sc.exe config "myService" obj= "MYDOMAIN\myuser" password= "<redacted>" Mar 17, 2023 at 20:26

10 Answers 10

9

Besides stopping the service before making the changes, and granting the user permission to logon as a service, I also had to add the type= own parameter, otherwise it would fail with:

[SC] ChangeServiceConfig FAILED 87:

The parameter is incorrect

So this is the command that worked:

SC.EXE config "ServiceName" type= own obj= "domain\user" password= "password"

It even worked with special characters in the password, given I had the password between double brackets.

1
  • type =own has no effect for me. SC command does not complain with or without "type =own". The problem is that after successfully creating the service, the service fails to start due to log on issues. Log on a service permission was granted to the user account.
    – Faustas
    May 5, 2022 at 21:57
7

When you configure a service to run under a specific account via the normal route from the service properties windows automatically grants the account the log in as service right. When you use sc.exe you also have to grant the user the log on as service right.

Log On As Service Right

2

Before restarting services, you should grant your user permission to logon as a service. Unfortunately, no way to do it from command line with default windows tools, but you can use small additional util ntright.exe from Windows Server 2003 Resource Kit Tools.

Download it from https://www.microsoft.com/en-us/download/details.aspx?id=17657

After installation you'll get a lot of tools in C:\Program Files (x86)\Windows Resource Kits\Tools (or in Program Files on 32bit machine).

You need ntrights.exe. You can copy it and run from any place on another host.

To grant your user required permission, you should add to your script:

ntrights.exe +r SeServiceLogonRight -u "%DOMAIN%\%USER%"

After that you can successfully restart services with a new user. Also there is an option to run ntrights.exe on remote host:

ntrights.exe +r SeServiceLogonRight -u "%DOMAIN%\%USER%" -m %HOSTNAME%

This tool helps me very much when I need reconfigure a lot of hosts remotely.

1

To enable log on as a service via script I've written this, you can use it as is or pull out what is useful to you

https://raw.githubusercontent.com/cdaf/windows/master/automation/provisioning/setServiceLogon.ps1

0

Try to stop the service before setting up the password:

sc.exe stop "<my_service>" 4:4:3
sc.exe config "<my_service>" obj= "\.<local_acc_name>" password= "<local_acc_pass>"
sc.exe start "<my_service>"
0

I had this issue. Thanks to ST's comment on the original post, I realized I needed to research how to type the password. In my case, I needed to double up the percent sign (%%) in the password.

The link ST provided is helpful: Escaping special characters in cmd.

0

Run against this problem while doing some Powershell scripting and the issue in my case was the special characters in the password.

Got it working by storing the password in a variable with double quotes around it:

$servicePassword = "`"passwordWithSpecialCharacters`"" cmd /c sc config myService obj= mydomain\myuser password= $servicePassword

Special characters are:

()'"$><^?

0
0

Try This. Start menu - type "local security policy" without the quotes. Open the "Local Policies", then left-click on "User Rights Assignment". On the right panel, right-click on "Log on as a service", and select "Properties". Click on "Add User or Group" and add your user. Click OK. You might have to reboot your machine.

After adding you can set the user name and password for the service in cmd.

0

When you configure a service to run under a specific virtual account ,

To configure a service to use a virtual account remember that the virtual service account's name should be same as the service name . Eg. **NT SERVICE**ServiceName.

0

Based on this simplified use case, there seems to be a core issue changing the password without using the GUI once. The same issue occurs when using Ansible win_service. I have tried rebooting before trying to reconfigure the logon user, but nothing works. After a service is created with default user...

Fails:

  1. sc.exe config "myService" obj= "MYDOMAIN\myuser" password= "BAD"
  2. sc.exe config "myService" obj= "MYDOMAIN\myuser" password= "redacted"

Succeeds:

  1. Set password to BAD via Windows service UI. (dark magic happening)
  2. sc.exe config "myService" obj= "MYDOMAIN\myuser" password= "redacted"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.