Non-interactive process launched by DCOM does not have network access

Non-interactive process launched by DCOM does not have network access

I have a DCOM server that when launched remotely, running in a 
non-interactive window station, does not have access to shared files on the 
network that the launching user should have access to. I am getting 
ERROR_ACCESS_DENIED.

Is this because of the way the DCOM Server Process Launcher logs the user 
in? What should I do if I want to run the DCOM server non-interactively but 
need it to be able to access shared files on the network?

Thanks,

Paul

date: Thu, 1 May 2008 13:50:49 -0400 author: Paul Baker [MVP, Windows Desktop Experience] am

RE: Non-interactive process launched by DCOM does not have network access

Hi Paul,

I am not a COM/DCOM expert, however, I have seen this problem in other 
services such as Asp.net. Yes, I think it is determined by the account that 
your DCOM server runs under. Can you tell me what account your DCOM server 
service process runs under? Regarding the share files, what account has the 
permission to access the share? 

I suspect only domain account has the access permission to the network 
share, while the DCOM process runs under a build-in service account such as 
Network Service, Local System or Local Service. So the DCOM process token 
has no permission to access the network share. 

Fortunately, the network share is maintained by the LAN session manager 
which provides the programming interface to establish a LAN session to the 
remote share. What we should do is providing the domain account 
username/password pair to the LAN session manager in the DCOM server. Then 
the LAN session will help to establish a separate LAN session channel using 
the provided credential. 
Note: the network share has two levels of permission settings --- 1. Share 
level. 2. NTFS level, so the domain account must have both permissions to 
pass these two levels. 

We have two solutions to establish LAN session: 
1. Leveraging the build-in Net.exe tool by calling the "net use" command. 
2. Calling LAN session APIs(NetUseAdd) directly. 

I provided the detailed sample code and explanation in the link 
below(although the code is provided in .Net p/invoke, the logic is easy to 
understand and use in C/C++):
http://groups.google.com/group/microsoft.public.platformsdk.security/msg/063
d7b08b29e5642

Hope this helps.

Best regards,
Jeffrey Tan
Microsoft Online Community Support

Delighting our customers is our #1 priority. We welcome your comments and 
suggestions about how we can improve the support we provide to you. Please 
feel free to let my manager know what you think of the level of service 
provided. You can send feedback directly to my manager at: 
msdnmg@microsoft.com.

==================================================
Get notification to my posts through email? Please refer to 
http://msdn.microsoft.com/subscriptions/managednewsgroups/default.aspx#notif
ications.

Note: The MSDN Managed Newsgroup support offering is for non-urgent issues 
where an initial response from the community or a Microsoft Support 
Engineer within 1 business day is acceptable. Please note that each follow 
up response may take approximately 2 business days as the support 
professional working with you may need further investigation to reach the 
most efficient resolution. The offering is not appropriate for situations 
that require urgent, real-time or phone-based interactions or complex 
project analysis and dump analysis issues. Issues of this nature are best 
handled working with a dedicated Microsoft Support Engineer by contacting 
Microsoft Customer Support Services (CSS) at 
http://msdn.microsoft.com/subscriptions/support/default.aspx.
==================================================
This posting is provided "AS IS" with no warranties, and confers no rights.

date: Fri, 02 May 2008 02:10:39 GMT author: (Jeffrey Tan[MSFT])