Home / server / Questions / 271371
In Process
mark
Asked: 2011-05-19 00:23:42 +0800 CST

How to add a privilege to an account in Windows?

  • 772

Given:

  • A VM running Windows 2008
  • I am logged on there using my domain account (SHUNRANET\markk)
  • I have added the "Create global objects" privilege to my domain account:
  • The VM is restarted (I know logout/logon is enough, but I had to restart)
  • I logon again using the same domain account. It seems still to have the privilege: enter image description here
  • I run some process and examine its Security properties using the Process Explorer. The account does not seem to have the privilege: enter image description here

This is not an idle curiousity. I have a real problem, that without this privilege the named pipe WCF binding works neither on Windows 2008 nor on Windows 7! Here is an interesting discussion on this matter - http://social.msdn.microsoft.com/forums/en-US/wcf/thread/b71cfd4d-3e7f-4d76-9561-1e6070414620.

Does anyone know how to make this work? Thanks.

EDIT

BTW, when I run the process elevated, everything is fine and the process explorer does display the privilege as expected:

enter image description here

But I do not want to run it elevated.

EDIT2

I equally welcome any solution. Be it configuration only or mixed with code.

EDIT3

I have posted the same question on MSDN forums and they have redirected me to this page - http://support.microsoft.com/default.aspx?scid=kb;EN-US;132958. I am yet to determine the relevance of it, but it looks promising.

Notice also that it is a completely coding solution that they propose, so whoever moved this post to the ServerFault - please reinstate it back in the StackOverflow.

windows security permissions wcf named-pipes

2 Answers

  1. If your NamedPipe WCF Service needs to be hosted in the Global objects to communicate between sessions I'd build it as a separate Windows Service and let the your other applications communicate with each other through the new Windows Service that will be hosting your NamedPipe WCF Service.

    • 1

  2. It because of a feature called UAC. Why don't you just turn it off? Then you won't need to run these tasks elevated, your account will just have this security permissions when you run the program normally.

    See here for an article I found about UAC and problems it can have with certain programs. It is specifically ansering a problem about Explorer but the principle still applies and it explains how UAC works and possible work arounds. http://think-like-a-computer.com/2011/05/11/uac-access-denied-on-folders-for-administrators-windows-2008/

    • 0