Windows Service with "Network Service" is not running

Question

Windows Service with "Network Service" is not running

Pushpala, Thejesh 0

Hi Team, I have created a Windows Service package (.exe) using Wix Installer. In "Service Install" tag Account="NT Authority\Network Service" changed from "LocalSYSTEM". I'm able to install the service. But for Account = "Network Service" it's not running. For only "LocalSystem" it is running. Could you please help me out in resolving this issue. I want to run the service Under "Network Service". Due to Cyber Security Team constraint i have changed the account type. Thanks in Advance, Regards, Thejesh.

0 comments

2 answers

Your answer

Answer 1

Hello Thejesh,

When you configure a Windows service to run under NT AUTHORITY\Network Service, the service process runs with a much more restricted token compared to LocalSystem. LocalSystem has almost unlimited privileges on the local machine, while Network Service is designed to run with limited rights and use the computer’s credentials when accessing network resources. If your service starts successfully under LocalSystem but fails under Network Service, it usually means the executable requires privileges or file system access that Network Service does not have by default.

The first step is to check the Windows Event Viewer under Windows Logs > System and Application for the exact service start error. Commonly you will see Error 1069: The service did not start due to a logon failure or Error 1053: The service did not respond to the start or control request in a timely fashion. If it is a logon failure, confirm that the service definition in your WiX installer uses the correct account string: NT AUTHORITY\NetworkService (note that the service account name must be NT AUTHORITY\NetworkService without a space). If it is a timeout or access error, you need to grant the Network Service account explicit permissions.

Check the directories and registry keys your service touches. For example, if the service writes to C:\ProgramData\YourApp or a custom log directory, ensure that NETWORK SERVICE has Modify rights on that folder. You can set this with icacls "C:\ProgramData\YourApp" /grant "NETWORK SERVICE":M. If the service needs to bind to a port below 1024 or access system resources, you may need to assign the SeServiceLogonRight and other privileges via Local Security Policy (secpol.msc) or ntrights.exe.

In short, the service is not broken; it is running into the expected restrictions of the Network Service account. Adjust your installer so that the account is specified correctly, and then grant the necessary file system and registry permissions to NETWORK SERVICE. Once those rights are in place, the service will start under Network Service as required by your security team.

I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!

Harry.

Pushpala, Thejesh 0 Reputation points

2026-01-05T10:26:53.6866667+00:00

Hi Harry,

Thanks for the detailed answer. I have tried it.

In Wix configuration file given Account = "NT AUTHORITY\NetworkService".

Also installed folder given "Network Service" full control permission.

But Still service start is failing. Getting "Error:1053"
Harry Phan 20,535 Reputation points Independent Advisor

2026-01-05T11:27:10.0266667+00:00

Okay, the issue is likely not with the installer but with how the service executable behaves under the restricted Network Service account.

I would recommend the few steps below:

Check Event Viewer (Application log): Look for exceptions or errors thrown by the service during startup. Error 1053 usually means the service process starts but fails to report “running” back to Windows.

Run the service interactively as Network Service:

Download Sysinternals PsExec.

Run: psexec -i -u "NT AUTHORITY\NetworkService" cmd.exe

Verify “Log on as a service” right: In Local Security Policy (secpol.msc), confirm that NETWORK SERVICE is explicitly listed under Log on as a service.

Check dependencies: If the service connects to databases, network shares, or other services, remember that Network Service uses the machine account (DOMAIN\ComputerName$) for authentication. Ensure that this account has the necessary access.

Timeout consideration: If initialization is heavy, you can increase the service startup timeout by setting HKLM\SYSTEM\CurrentControlSet\Control\ServicesPipeTimeout (DWORD, milliseconds).

In short, the configuration is correct, but the service code is likely failing under the restricted rights of Network Service. Running it interactively with PsExec will help pinpoint the exact error so we can grant the required permissions or adjust dependencies.

Answer 2

When running a Windows Service under the "Network Service" account, there are a few considerations to ensure it operates correctly:

Permissions: The "Network Service" account has limited permissions compared to the "LocalSystem" account. Ensure that the service has the necessary permissions to access resources it needs, such as files, databases, or network resources. You may need to adjust the permissions on these resources to allow access for the "Network Service" account.
Logon as Service Right: The account under which the service runs must have the right to log on as a service. For the "Network Service" account, this right is typically granted by default, but you can verify this in the Local Security Policy under Local Policies > User Rights Assignment.
Dependencies: Check if your service has any dependencies that might require higher privileges. If your service interacts with other services or components that require administrative rights, it might fail to start under the "Network Service" account.
Event Logs: Check the Windows Event Viewer for any error messages related to the service. This can provide clues as to why the service is not starting when configured to run under the "Network Service" account.
Service Configuration: Ensure that the service is correctly configured in the installer. Sometimes, issues can arise from misconfigurations in the installer script.

If after checking these points the service still does not run, consider testing with a different account that has the necessary permissions or consult with your Cyber Security Team for further guidance on acceptable configurations.

References:

Share via

Windows Service with "Network Service" is not running

2 answers

Your answer