Hello:
I found an example of a VB program that can be run as an NT Service. From
this service I start another program with the CreateProcess API. Since the
service runs all processes within the LocalSystem account, I cant access
the process once I log on as the SA. I read some doc about creating a NULL
DACL. When I start the process using the NULL DACL created with the api's
for creating SD's, the process wont start at all. Am I on the right track
to get the service accessable from an account other than LocalSystem? Any
help anyone can give would be great!!
Thanks
Bill

Sorry if this is rubbish as I am an NT newbie. Do you have to run all
services in the LocalSystem account? If you select Services in control
panel, can't you assign a service to any account?

P.S. No need to waste time putting me right if this is indeed rubbish.

Bill,

1. Use the impersonation API's to create a second thread, thereby getting
those additional Priv's for your 2nd process

2. Or maybe you could just start your service under a named account
(controlpanel/service/servicename/startup......), this account should
obviously have the various privs already setup.

You would normally communicate with a service process via a bespoke service
control application, either using TCP/IP, Named Pipes etc, this is the
application your SA account would use...

You could also use COM Interfaces, this has the added benefit of  being easy
in VB(5) and happens to be *fashionable* to boot.

Regards
AndyS