1921: Conundrum of Service installation & permissions
Here's my issue: My product has an auto-updater feature. It runs as a service and can launch executables - in this case, a setup.exe that will update the product itself.
By default, the auto-updater service logs on as Local System, and was deliberately designed to not impersonate a user. Executables that are launched by the updater run as user SYSTEM.
If I -- logged in as administrator -- manually launch a major upgrade from, say, version 2.0 to version 3.0 of our product, it works like charm.
If the auto-updater launches that upgrade, the installation of version 3.0 gets rolled back as a result of a 1921 error: Error 1921.Service <> (<>) could not be stopped. Verify that you have sufficient privileges to stop system services. MSI (s) (B0:14) [09:19:09:917]: User policy value 'DisableRollback' is 0"
Question 1) This is confusing enough. Why wouldn't the SYSTEM user have enough privileges to stop a service?
It gets worse. In a separate test, I modified the version 2.0 updater service's logon to the Administrator account. That way, when the 3.0 installer was launched, it would be running as Administrator user (supposedly just like it was when I launch it manually). This too rolled back with an identical 1921 error!
Question 2) Why would it matter whether I manually launch version 3.0 as administrator vs. a service launching 3.0 as administrator?
Now, I don't expect that I've provided enough information here for anyone to be able to answer my question (though if you can please do!) but if you have any angles to research, I'm spent! This makes no sense to me!
if your service is waiting for a response from the updater it is launching it is possible that you are trying to shut down or remove the service while it is in a state that will not allow this.
I have run into this problem in the past of not being able to stop or uninstall a service because of the actions it was taking at the time could not be interupted by the user account that was trying to override it.
In this case if it is launching the setup.exe as a subprocess killing the service would result in killing the process that is doing the update, therefor it will not allow you to kill the process.
not sure if this will help you, but it is something to look into.
