在网络服务帐户下访问 Windows 共享

Question

I have two computers with Windows Server 2003. One computer has some shared folders on the network, and the other has a Windows Service (written in C#, running under the Network Service account) that needs to access those shared folders.

The following code works fine as a logged-in user, but throws an exception when executed under the Network Service account.

File.WriteAllText(@"C:\temp\temp.txt", File.ReadAllLines(@"\\NetworkServer\Test\test.txt")[0]);

The exception message is Logon failure: unknown user name or bad password . How do I get this code to work under the Network Service account? Is it a setting in Windows Server 2003, or do I need to add some code to this to make it work?

Answer 1

On the network share, you'll need to add permissions for the "Network Service" account on the server running the service. While this will work, @nicholas points out that this may provide an overly broad group of users access to the share.

Another option, and in my opinion the better option , is to create a domain account and then give that account read/write permission on the share. Then you configure the service to "run as" the domain account with proper permissions.

Answer 2

@Nate's answer is either incorrect or is unclear, as far as I can tell. It doesn't explain how Network Service authenticates on the network.

Network Service account has very limited privileges on a local system, it presents the computers's credentials on the network. So if you need to access a network resource (eg a network share) under Network Service account, you have to grant access to the computer's account where the service works.

Providing local Network Service account with access to a network resource won't work at all, you'll keep getting authentication / authorization errors.

See MDSN "NetworkService Account" reference .

Answer 3

When the Network Service account attempts to access a share on a remote server, it authenticates on the network using the computer account. This account will be suffixed with $ (like servername$ ) when granted permission.

When the Network Service account attempts to access a share hosted on the SAME SERVER AS ITSELF, the computer account will NOT be able to grant the network service access. In this event, the Network Service built-in account will need to be granted access BOTH to the filesystem location AND the share permissions.

Basically, when you grant Network Service access to a share, it only will affect services running as that identity on the local machine. For remote machines, the computer account must be used, and the computer account cannot be used for granting access to local resources to Network Service.