Setting up the basic runtime's Windows service

Configure Windows services for a basic runtime from your computer's Control Panel.

Before you begin

Before completing these steps, install the initial runtime node.

Procedure

1. After installing the runtime, go to Control Panel > Administrative Tools > Services.

2. Right-click the runtime service and select Properties.

3. Click the Log On tab. By default the service logs on as "Local System Account".

4. Change the service to log on as an account that has access to the shared directory.

5. If the user is a service user and not a local administrator, then you need to grant the user permission to start and stop the service. See the following articles on Windows Service Security:

   • https://docs.microsoft.com/en-us/windows/win32/services/controlling-a-service-using-sc

   • http://technet.microsoft.com/en-us/library/cc742133%28WS.10%29.aspx

   • http://technet.microsoft.com/en-us/library/cc742037%28WS.10%29.aspx

6. Get the SID of the Windows user you want to grant access to; typically this is in the form of: S-1-5-21-XXXX-XXXX-XXXX-XXXX

7. Get the Service DACL of the runtime service on a particular computer. Run the following command, replacing "Atom Service Name" with the name of the service that you installed: sc sdshow "Atom Service Name" This command returns a long Service DACL string like this: (The following is an example only.)

   D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRCWP;;;SU)(A;;CR;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

8. Add the following string to the DACL using the SID. Insert this before the S: at the end of the DACL: (A;;CCLCRPWPRC;;; S-1-5-21-XXXX-XXXX-XXXX-XXXX) This grants stop and start capabilities to this specific user on this specific computer. The new DACL looks like this: (The following is an example only.)

   D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRCWP;;;SU)(A;;CR;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)(A;;CCLCRPWPRC;;; S-1-5-21-XXXX-XXXX-XXXX-XXXX)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

9. To set the new DACL, run the following command, and ensure you replace the appropriate variables. Use the DACL from your computer, not the one provided here. Remember to remove newlines.

   sc sdset "Atom Service Name" "D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRCWP;;;SU)(A;;CR;;;AU)(A;;CCLCSWRPWPDTLOCRRC;;;PU)(A;;CCLCRPWPRC;;; S-1-5-21-XXXX-XXXX-XXXX-XXXX)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)"

10. Start the service.

Results

You can view the runtime online by going to the Manage menu and selecting Runtime Management.