Unable to access network printers from C# windows service which runs under LocalSystem account

Question

_{Wednesday, October 14, 2015 6:54 AM}

Hi,

We are setting up a Windows Service that will need to have access to network printers.  I get all the network printers using System.Drawing.Printing.PrinterSettings.InstalledPrinters from console application which by default runs with my domain credentials. However, from my Windows service which runs under LocalSystem Account the code fails to get the network printers. If I change the windows service to run with domain credentials instead of LocalSystem, then it works. I need to understand what will be the best solution to get all the network printers when the service is still running under LocalSystem account. If I make my windows service to run under domain credentials then it will become additional burden to update the password whenever the password for that account is reset. Also I would like to hear any alternate feasible solution.

Thanks,

Mallikarjun

All replies (7)

_{Thursday, October 15, 2015 2:05 PM ✅Answered}

You can use a service to access network printers.  There is nothing wrong with that approach provided the functionality of the service is such that it needs to be running continuously. 

Assuming that a service is the correct choice you have to run the service with an account that has network privileges. The built in NetworkService account was designed for this purpose. It is equivalent to LocalService except it has access to the network. 

If your printers are secured then a domain account may be a better choice but if you want to use the NS account then you'll need to give the machine running the service access to the printers using the machine name.

Michael Taylor
http://blogs.msmvps.com/p3net

_{Wednesday, October 14, 2015 9:48 AM}

However, from my Windows service which runs under LocalSystem Account the code fails to get the network printers. If I change the windows service to run with domain credentials instead of LocalSystem, then it works.

What are you expecting? The Domain user and the Local System account are two totally different pairs of shoes, in two totally different households.
You never granted any "Local System" account rights to access any printers in your network or the local printer queues. I mean why would you or any admin ever do that?

What does this Service has to do besides accessing the Printers? How many rights does it need on the local machine and the network as whole?

_{Wednesday, October 14, 2015 3:38 PM}

Thanks for the response.

I mean if I run my windows service account with dedicated user account then the service is able to get all the network printers whereas if the windows service runs under “LocalSystem” Account, then the network printers are not listed. The service just looks for network printers and sends the printing job request for any one.  I understand “LocalSystem” account is predefined local account which is not recognized by security subsystem and has extensive privileges on the local computer, and acts as the computer on the network. I need to understand what will be the best feasible/alternate solution to get all the network printers when the service is still running under LocalSystem account.

_{Wednesday, October 14, 2015 4:00 PM}

Thanks for the response.

I mean if I run my windows service account with dedicated user account then the service is able to get all the network printers whereas if the windows service runs under “LocalSystem” Account, then the network printers are not listed. The service just looks for network printers and sends the printing job request for any one.  I understand “LocalSystem” account is predefined local account which is not recognized by security subsystem and has extensive privileges on the local computer, and acts as the computer on the network. I need to understand what will be the best feasible/alternate solution to get all the network printers when the service is still running under LocalSystem account.

It seems to me that a Windows Service may not be the right approach, possibly, because you need to  use a domain account in this situation. Maybe, you need to use a Windows desktop based solution an exe,  stripping out all Windows form logic so that it's just an exe with no forms to be displayed. You can start the exe at  boot/login using a predefined domain account it is to present  and it is just sitting there as a running process, because that really all a Windows service is,  or you can use the predefined domain account that the Windows Service can present.

_{Thursday, October 15, 2015 6:27 AM}

Thanks.

I have a question. When I start the exe at boot/login time, do I still need to configure any pre-defined account?  Or will the exe automatically take the current user account context to get all the network printers?

Thanks,

Mallikarjun

_{Thursday, October 15, 2015 12:04 PM}

Thanks.

I have a question. When I start the exe at boot/login time, do I still need to configure any pre-defined account?  Or will the exe automatically take the current user account context to get all the network printers?

Thanks,

Mallikarjun

You would have to use the Runas pointing do a generic domain account that has the power to access the network.

http://www.windows-commandline.com/windows-runas-command-prompt/

_{Friday, October 16, 2015 3:07 PM}

FYI, the rendering methods from System.Drawing.Printing are unsupported in session zero (but the enumeration methods typically work...).

WinSDK Support Team Blog: http://blogs.msdn.com/b/winsdk/