System error 5 Access is denied when starting a .NET service

When I try to start a service I created in Visual Studio I receive the following error:

System error 5 has occurred.

Access is denied.

I am running the command line with elevated privileges, so it's not that problem. Is there any place I can look to see what error is occuring.

To get it to work I needed to add permissions to the output bin\debug folder for my service project.

The Local Service account didn't have permissions to the output .exe file, and this was why the error was occuring.

Had the same issue.

Fixed by running the service under "Local System Account"

In my case the solution was even that simple: Run Command Prompt as administrator.

I see you've fixed the problem; but in reality, you shouldn't normally be running the service from a project's bin folder anyway - the files should be put somewhere project and profile independent (for example, under program files). For debugging purposes (when it will be in the bin folder), you can detect whether it is a service in Main(), and if it is being run interactively just run the service code directly, rather than the usual service-start setup.

You can detect either by adding a command line argument, or you can try checking Environment.UserInteractive.

The Local Services account doesn't seem to be privileged to control a service. So, in the service's LogOn Property, change the account type to Local System and allow service to interact with desktop.

Also, make sure that, you install the service using instalutil, as an administrator.

Lastly, when you want to run a service from the command prompt using the "net start [service name]" command, you have to run the command prompt as an administrator.

I had the same problem because my project and its source code was in a folder that had NTFS's Encrypting File System (EFS) enabled. This caused by compiled assemblies being encrypted aswell and the user running my service didn't have permissions to decrypt them. Removing EFS was the easy solution for this. It can be done by command line using CIPHER.EXE, which is a Windows tool.

I had the same problem when I migrated a service from vs05 to vs2010, from framework 2.0 till framework 4.0 at the same time. I got Access denied. As soon as a change back to framework 2.0 it worked again. The ?%¤#%&%& problem was that the initializing string for the service was incorrect (?!). The string expected quotes at the beginning and at the end!

Before....path + service name" "/parameter=1 ' this had worked with framework 2.0

After...."path + service name" "/parameter=1"

Access Denied has nothing to do with the problem. Why not "Path not found " or "missing parameter"

Run it from Task Scheduler with highest privileges and it will work.

A user account with administrator rights will prompt “are you sure?” in situations where the administrator account is not prompted. I had this problem with net stop netprofm.

To remove the prompt do this.

Control Panel, User Accounts, Change User Account Control settings, never notify

This seems to provide the user account with admin rights the same behavior as a the administrator account.

Just ran into this issue after I had run an 'sc config' to change binPath of the service.

The only fix that worked for me was to 'sc delete' the service and install again.

Things worked perfectly after that.

Do not simply start the service under a different username or admin. (Unless your service actually requires admin privileges of course!) This is a security hole and creates a bad user experience.

The actual issue is that the service hasn't been assigned any permissions in the first place.

However, it must be noted that Microsoft didn't exactly make them easy to change - service permissions are similar to regular file permissions but unfortunately cannot be altered with a simple right click. They can however be read via:

sc.exe sdshow <service name>

And written via:

sc.exe sdset <service name> <permissions>

• <service name> is your service name.
• <permissions> is the permissions in SDDL format.

So use sdshow to get the permissions, then sdset to update them with your requirement(s). SDDL a cacophony of seemingly random letters beyond the scope of this post and more reminiscent of Unix than Windows. In short instance adding the descriptor (A;;RPWP;;;WD) would allow (A) everyone (WD) to start (RP) and stop (WP) the named service.