Re: Re: Cannot start Postgresql 9.3 as a service in Windows 2012 Server with a domain account - Mailing list pgsql-general

From Krystian Bigaj
Subject Re: Re: Cannot start Postgresql 9.3 as a service in Windows 2012 Server with a domain account
Date
Msg-id CAN=kAeEjMb4=y6qupLLRpeygjykDfT0Gj6Pr_DQ0MfJORBxWxQ@mail.gmail.com
Whole thread Raw
In response to Re: Cannot start Postgresql 9.3 as a service in Windows 2012 Server with a domain account  (boca2608 <boca2608@gmail.com>)
Responses Re: Cannot start Postgresql 9.3 as a service in Windows 2012 Server with a domain account
List pgsql-general

On 12 June 2014 15:59, boca2608 <boca2608@gmail.com> wrote:
Krystian Bigaj replied this in a separate email, which led to some
interesting information that I would like to share in this mailing list.

He suggested the use of the "Process Monitor" app to log the process events
during the startup of the service and look for "ACCESS DENIED" errors.  Here
is what I found.  During the startup, there were indeed several ACCESS
DENIED errors:

Date & Time: 6/12/2014 9:27:41 AM
Event Class: Registry
Operation: RegOpenKey
Result: ACCESS DENIED
Path: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution
Options
TID: 1964
Duration: 0.0000451
Desired Access: Query Value, Enumerate Sub KeysI had similar problem (but with initdb.exe).
Solution in your case is to add BUILTIN\Users group to your "postgres" account (this which you will use to start PG service).

Let me know if this helps.

PS. Don't change permissions on registry/file, because you will end up with a mess :)
Of course your PG data directory must have Full access for postgress account. Also your binaries must have a Read+Execute access for postgress. In most cases adding that BUILTIN\Users group to postgress will work, but I had a case, where end-user installed our software on drive where Users group had Deny permissions.

To sum it all:
- directory with your pgdata - Full access for postgress account
- PG installation dir (so parent of bin) - Read+Execute for postgress account
- postgres account must be member of BUILTIN\Users (!)
- if you are redirecting Log to other directory, then this dir also have to Full access for postgres account.

(I'm using "NT AUTHORITY\NetworkService" account)

Best regards,
Krystian Bigaj

pgsql-general by date:

Previous
From: Magnus Hagander
Date:
Subject: Re: OpenSSL Vulnerabilities
Next
From: Krystian Bigaj
Date:
Subject: Re: Re: Cannot start Postgresql 9.3 as a service in Windows 2012 Server with a domain account