Run Fax Service under a different User Account gives "Win32 Error Code: 1307" error

[Bill Bartlett]

On a Windows Server 2003 server, I am attempting to run the Fax Service on
an account other than the "Network Service" account, but getting the
following error when trying to start the fax service:

"Fax Service failed to initialize because of an internal error

Win32 Error Code: 1307.
This error code indicates the cause of the error."

The server is a standalone [in a workgroup, not in a domain] server. The
account under which I am trying to run the fax service is [at the moment] a
member of the local Administrators domain, with the following permissions
added:

Adjust memory quotas for a process
Generate security audits
Log on as a batch job
Log on as a service
Replace a process level token


(The purpose of running the fax service under a different account is to
ultimately give the fax service access to files that have been encrypted
with the Encrypted File System, but this is not yet configured so this is
not part of the problem.)

Any ideas?

- Bill

 

[Renu Bhattar [MSFT]]

How about running Fax under Network Service and giving Network Service
access to files in the Encrypted File System.

---
Renu Bhattar [MSFT]

Microsoft Printing, Imaging and Faxing
This posting isprovided "AS IS" with no warranties and confers no rights.
Please do not send mail directly to this alias. This alias is for newsgroup
purposes only.

 

[Bill Bartlett]

I've been trying to do that, but I can't seem to get the certificates to
work properly when installed under the service itself rather than for a user
running the service. (I have an open thread on
microsoft.public.security.crypto right now trying to address this. However,
the problem I'm having with that seems to apply to getting the certificates
to work properly on any service, not just the fax service.)

However, I only want to give the fax service itself access to the encrypted
files. I wouldn't want to give the "Network Service" account access to the
encrypted files because then any service running under the Network Service
account, including services that could get installed later for which I have
no control, would then have access to the encrypted files. Also, since I
can't actually log on to the machine as the Network Service account, I don't
know of any way to install the certificate for the Network Service user.
(The only way I can see to do that is to install the certificate for the
service via the Certificates snap-in for MMC and installing the certificate
for the service, but that's what doesn't seem to be working.)

Is there any additional logging or debugging I can turn on for the fax
service to get more information on what the underlying problem is?

- Bill

How about running Fax under Network Service and giving Network Service
access to files in the Encrypted File System.

---
Renu Bhattar [MSFT]

Microsoft Printing, Imaging and Faxing
This posting isprovided "AS IS" with no warranties and confers no rights.
Please do not send mail directly to this alias. This alias is for
newsgroup
purposes only.

On a Windows Server 2003 server, I am attempting to run the Fax Service
on an account other than the "Network Service" account, but getting the
following error when trying to start the fax service:

"Fax Service failed to initialize because of an internal error

Win32 Error Code: 1307.
This error code indicates the cause of the error."

The server is a standalone [in a workgroup, not in a domain] server. The
account under which I am trying to run the fax service is [at the moment]
a member of the local Administrators domain, with the following
permissions added:

Adjust memory quotas for a process
Generate security audits
Log on as a batch job
Log on as a service
Replace a process level token


(The purpose of running the fax service under a different account is to
ultimately give the fax service access to files that have been encrypted
with the Encrypted File System, but this is not yet configured so this is
not part of the problem.)

Any ideas?

- Bill

 

[Bill Bartlett]

Checking to see if anyone could provide any more information on this ...

- Bill

I've been trying to do that, but I can't seem to get the certificates to
work properly when installed under the service itself rather than for a
user running the service. (I have an open thread on
microsoft.public.security.crypto right now trying to address this.
However, the problem I'm having with that seems to apply to getting the
certificates to work properly on any service, not just the fax service.)

However, I only want to give the fax service itself access to the
encrypted files. I wouldn't want to give the "Network Service" account
access to the encrypted files because then any service running under the
Network Service account, including services that could get installed later
for which I have no control, would then have access to the encrypted
files. Also, since I can't actually log on to the machine as the Network
Service account, I don't know of any way to install the certificate for
the Network Service user. (The only way I can see to do that is to install
the certificate for the service via the Certificates snap-in for MMC and
installing the certificate for the service, but that's what doesn't seem
to be working.)

Is there any additional logging or debugging I can turn on for the fax
service to get more information on what the underlying problem is?

- Bill

How about running Fax under Network Service and giving Network Service
access to files in the Encrypted File System.

---
Renu Bhattar [MSFT]

Microsoft Printing, Imaging and Faxing
This posting isprovided "AS IS" with no warranties and confers no rights.
Please do not send mail directly to this alias. This alias is for
newsgroup
purposes only.

On a Windows Server 2003 server, I am attempting to run the Fax Service
on an account other than the "Network Service" account, but getting the
following error when trying to start the fax service:

"Fax Service failed to initialize because of an internal error

Win32 Error Code: 1307.
This error code indicates the cause of the error."

The server is a standalone [in a workgroup, not in a domain] server.
The account under which I am trying to run the fax service is [at the
moment] a member of the local Administrators domain, with the following
permissions added:

Adjust memory quotas for a process
Generate security audits
Log on as a batch job
Log on as a service
Replace a process level token


(The purpose of running the fax service under a different account is to
ultimately give the fax service access to files that have been encrypted
with the Encrypted File System, but this is not yet configured so this
is not part of the problem.)

Any ideas?

- Bill