Why do clients calling a grpc server via named pipes which is hosted in a windows service require admin rights?

Question

Why do clients calling a grpc server via named pipes which is hosted in a windows service require admin rights?

Stephen Richardson 41

I have a grpc service which uses named pipes, it is hosted in a Windows service. If my client is running with admin rights it is able to call the service otherwise it fails with an UnauthorizedAccessException.

This is a replacement for an old WCF service which worked OK because the Windows service made the named pipe visible to processes in other logon sessions on the same machine. Has this behaviour changed with grpc?

RLWA32 49,536 Reputation points

2024-01-02T14:45:30.3066667+00:00

If a named pipe created by a Windows service was not visible to an application running in a logged on user's interactive session the application would likely fail with some kind of file not found error. An exception indicative of access denied suggests you check the named pipe security descriptor. You can probably use Sysinternals Process Explorer to do this.
Somen 0 Reputation points

2024-11-01T21:53:49.7433333+00:00

Interesting, I have experienced an issue where if I set up my service using local service, clients are not able to connect to the namedpipe server. If the service is running under local system. The connection can be made. Note that the security descriptor set on the named pipe is everyone. I wonder why this is the case. The error is timed out
RLWA32 49,536 Reputation points

2024-11-02T16:51:55.3233333+00:00

@Somen, I haven't had problems with clients connecting to a named pipe created by a Windows service running as LocalService.If you want to pursue the issue I suggest you ask a new question and provide relevant code regarding pipe creation and access for both the service and the client.

Your answer

RLWA32 49,536 Reputation points

2024-01-02T14:45:30.3066667+00:00

If a named pipe created by a Windows service was not visible to an application running in a logged on user's interactive session the application would likely fail with some kind of file not found error. An exception indicative of access denied suggests you check the named pipe security descriptor. You can probably use Sysinternals Process Explorer to do this.
Somen 0 Reputation points

2024-11-01T21:53:49.7433333+00:00

Interesting, I have experienced an issue where if I set up my service using local service, clients are not able to connect to the namedpipe server. If the service is running under local system. The connection can be made. Note that the security descriptor set on the named pipe is everyone. I wonder why this is the case. The error is timed out
RLWA32 49,536 Reputation points

2024-11-02T16:51:55.3233333+00:00

@Somen, I haven't had problems with clients connecting to a named pipe created by a Windows service running as LocalService.If you want to pursue the issue I suggest you ask a new question and provide relevant code regarding pipe creation and access for both the service and the client.

Share via

Why do clients calling a grpc server via named pipes which is hosted in a windows service require admin rights?

Your answer