Access denied errors in RCC and console hanging

meppyman · Post by **meppyman** » Sat Sep 19, 2009 6:33 am

I was having a few strange problems with HM running as a service on Windows SBS 2003 R2...

From RCC I keep getting errors saying I don't have permission to save files in C:\Program Files\HostMonitor8 etc. Yet the settings seemed to stick. When I checked the console which was open the whole time, it was showing some old colours and settings. Tried to close the console and it just hung, stopping the console UI stopped the monitoring service.

I restarted the service and it appears to be working ok now. Will report back if it shows this behaviour again. I did have a few challenges understanding how to set the service up properly to start with so maybe something got out of whack then?

RCC always takes a little while to close after I hit the close button, and the Console still wont close for me on the server. Checking the event log on the server I see a Uknown Error for hostmon.exe that has reports this:

Unable to write to C:\Program Files\HostMonitor8\hostmon.ini. Perhaps the service account needs to be a local administrator?

Yep that seems to have fixed it. I will probably now find detailed step by step instructions on setting up the service account that I missed earlier?

KS-Soft · Post by **KS-Soft** » Sat Sep 19, 2009 10:50 am

I don't think there is some bug. If application/service was started under account that does not have necessary rights, its not a bug. Its your configuration mistake.

There are 2 different places to provide account for HostMonitor service
1) Windows Services applet. Use default settings there - "local system" account
2) HostMonitor Options dialog -> Service page. Provide local admin account here.

Quote from the manual
====================
How to install HostMonitor as Win32 Interactive service
...
IMPORTANT NOTES:

Note #1: When HostMonitor starts as a service, it uses the system account (as all interactive services). But this account may not have all the necessary permissions, so some tests will not work correctly (UNC test, "disk free space" test for shared drives, "CPU Usage" test for remote machines, etc). If you need these tests, you will need to assign a special user account on the Service page in the Options dialog. In this case HostMonitor will impersonate the security context of the user. Do not change the account using the system utility "Services". If you do so, HostMonitor may be unable to interact with the desktop.

Note #2: We do not recommend installing HostMonitor as a service under Windows NT 4.0. At least not as an interactive service. In the case you really need to start HostMonitor as a service on Windows NT, please, disable the "Allow service to interact with desktop" option for HostMonitor service (option provided by Windows Services applet). In this case you will not be able to see HostMonitor's icon in the system tray.

Note #3: In some cases Win32 service is unable to interact with desktop. There are 3 most common reasons:
1) You have disabled "Allow service to interact with desktop" option
2) Service is running on remote system and you are using Terminal Service to login to that system
3) You are using Windows Vista or Windows Server 2008
It's pretty easy to enable "Allow service to interact with desktop" option but how to manage HostMonitor that is running as service on remote system / on Windows Vista?
There are 2 possible solutions:
- Use Remote Control Console (RCC) that allows you to manage HostMonitor started on local or remote system in service or application mode.
- You may create simple BAT file that will stop service, start HostMonitor in application mode and (after you change settings and terminate application) start service again.
E.g.
net stop hostmonservice
"c:\program files\hostmon\hostmon.exe"
net start hostmonservice

Note #4: There is common mistake - install HostMonitor as service, start service, then start application. Please DO NOT start several instances of HostMonitor on the same system using the same installation folder and configuration files. If you do so, several instances will work simultaneously, monitor the same target systems, and launch the same actions. If you modify test settings or profiles using 2nd instance of the software (application), 1st instance (service) will not apply modifications until you restart service. Also, your log files and statistical information will not be accurate when you are running several instances of the monitor using the same log files.
That's why HostMonitor warns you when you are trying to start application while service is running as well.
====================

Regards
Alex

meppyman · Post by **meppyman** » Sun Sep 20, 2009 2:58 am

Yep I read all that and followed all that (in the end) but it doesn't actually tell you what permissions the service accont will need. I gave it log on locally and log on as a service, but it needs admin rights and/or permissions on the HostMonitor8 folder. Maybe this should be added to the instructions?

KS-Soft · Post by **KS-Soft** » Mon Sep 21, 2009 6:23 pm

Yep I read all that and followed all that (in the end) but it doesn't actually tell you what permissions the service accont will need.

It depends on tests you are using. If you are using CPU Usage, Performance Counter and Process test methods, you should use admin account. If you are using Service, NT Event Log tests, you may use Power User account (while admin account will work fine as well). If you are using just Ping, TCP, UDP, SMTP, SNMP, Traffic Monitor and other tests based right on top of TCP/IP stack, you don't need to provide any special account.

Regards
Alex

meppyman · Post by **meppyman** » Mon Sep 21, 2009 7:31 pm

KS-Soft wrote:
If you are using just Ping, TCP, UDP, SMTP, SNMP, Traffic Monitor and other tests based right on top of TCP/IP stack, you don't need to provide any special account.
But surely I would still get errors trying to write to C:\Program Files\HostMonitor8\hostmon.ini on the server when making remote changes to the RCC?

KS-Soft · Post by **KS-Soft** » Mon Sep 21, 2009 8:19 pm

No, normally HostMonitor should be able to write to this file. Please check permissions for this folder.

Regards
Alex

meppyman · Post by **meppyman** » Tue Sep 22, 2009 4:42 am

All permissions are as I would expect for Program Files folder:
System has full control
Auth Users have Read & Execute
Admins have full control
Server Ops have Modify

Anything missing?

KS-Soft · Post by **KS-Soft** » Tue Sep 22, 2009 9:40 am

What account is specified for HostMonitor service itself (Windows Services applet)?
Could you please send screen shot of this error to support@ks-soft.net?

Regards
Alex

meppyman · Post by **meppyman** » Tue Sep 22, 2009 5:51 pm

As specified in your instructions it is the local system account with allow service to interact with desktop. I can send a screenshot but it will not tell you anything more than that

KS-Soft · Post by **KS-Soft** » Fri Oct 02, 2009 10:20 am

Is this problem fixed? If not, could you please send screen shot to support@ks-soft.net? Its hard to say what is wrong on system when we do not have any access to that system. Who knows, may be we get some information from that screen shot...
BTW: We still do not think this problem is caused by mistake (bug) in our software. For some reason your system does not allow HostMonitor to write the file. That's it. May be somebody set "read-only" attribute, may be there is some antivirus side effect...

Regards
Alex

meppyman · Post by **meppyman** » Sat Oct 03, 2009 1:40 am

I added the service account used in HM options dialog box to the administrators group which resolved the problem. So this leads me to think that the ini file is accessed using those credentials and not the local system account but I Would need to run process explorer to confirm this.

Let me know what you want a screenshot of and I will be happy to oblige.

KS-Soft · Post by **KS-Soft** » Sat Oct 03, 2009 2:59 pm

So, you have used account that does not have "write" permission? That's why HostMonitor reported error.

Regards
Alex

meppyman · Post by **meppyman** » Wed Oct 14, 2009 6:03 am

I did not see in the instructions details on what folders and files this "service" account needed to write to, did I miss it? It just says it will impersonate the user, what it obviously needs to do is impersonate someone with elevated privileges.

KS-Soft · Post by **KS-Soft** » Wed Oct 14, 2009 10:18 am

Many test methods require account with admin rights: Process test, Dominant Process, Performance Counter, CPU Usage. Also usually admin has "write" rights. Please specify such account and everything will should work fine

Regards
Alex