Starting Windows Service with Domain User Gives: Error 5: Access is Denied

Question

I have a Topshelf Windows Service that installs and starts just fine when I run it as local system.

But when I switch to a domain user (or network service), I get the following error:

Windows could not start the My Cool Custom Service service on Local Computer.

Error 5: Access is denied.

I am left wondering if it is my domain user that I am running the service as that does not have permissions, or if it is me personally that does not have permissions to start a service as a non Local System user.

How can I get this service to start up?

NOTES:

Things I have tried:

• Granting the domain user full access to the folder that has the binaries.
• Running SubInAcl.exe to grant the domain user permissions to the service.
• Running SubInAcl.exe to grant me permissions to the service.
• Starting the service from a console that has admin permissions:
  • TopShelf CLI Command Run: MyCoolService.exe start
  • Error: The service failed to start., System.ServiceProcess.TimeoutException: Time out has expired and the operation has not been completed.

Answer 1

I decided to try to work around this by running as Local System and then impersonating the user I want to make my calls.

Well, turns out that this issue is that my Windows Service starts up a self hosted SignalR service at startup. That call is what was giving the Access is Denied error.

If I let Local System start the SignalR service then do the rest of the stuff with my domain user it works fine.

(I will likely post a question on how to grant my user rights to start a SignalR service...)