winsvc | Windows service library written in go - Forked from http

The error indicates that you do not have permission to ingest data into the specific table you are trying to ingest the data to.

Please note that a person with "user" access, cannot ingest data to a table that was not created by that person.

Please ensure that your identity has "ingestor" permission on the specific table or for the database. You can do it through the Azure portal or using the applicable commands.

TaskScheduler doesn't directly support running services, but you can use a command-line operation to instruct the SCM to start the service (ie, net start ""). You can use whatever account you want to run the operation, but the account that the service will use is specified in the service's own configuration. The SCM will simply run the service in whatever account has been configured. That will be NT AUTHORITY\SYSTEM by default, if another account is not specified.

As you point out, changes to service host grouping in Windows 10 may result in services of type SERVICE_WIN32_SHARE_PROCESS running in their own, isolated process. Whenever that happens to a service, SC will show it as SERVICE_WIN32 -- the confusing union of SERVICE_WIN32_OWN_PROCESS and SERVICE_WIN32_SHARE_PROCESS.

We've confirmed this situation by playing with the registry.

On our Windows 10 VM (which has ample RAM to trigger the process isolation enhancements), SC says AppInfo is of type WIN32 (30):

Task Manager reported that AppInfo was running in its own process.

As per the documentation, we disabled process isolation for the AppInfo service by adding the SvcHostSplitDisable value:

And after a reboot, SC reported AppInfo of type WIN32_SHARE_PROCESS (20):

The Task Manager confirmed that the process was indeed shared.

So its all down to those changes to service process isolation in Windows 10 Creators Update (version 1703).

I have faced the same problem as you and the problem is caused from your ProcessIDFromAppname32('winlogon.exe') as it keeps retrieving the process ID of the first logged in user's session ID. You can try adding in this code snippet to compare and get the process ID of the currently logged in user's session ID.

OpenSCManager of course uses a special, fast path, to connect to the local service control manager. for use this fast path OpenSCManager need somehow detect that we want connect to local database. this of course done by check lpMachineName. the best and documented variant - will be use NULL pointer here. then almost same effect will be if use empty string. then possible OpenSCManager can compare lpMachineName with some hard-coded strings. in my test, it compare lpMachineName with localhost and . and if not match - need go to slow path. for 127.0.0.1 string function not check.

for compare fast and slow path, some internal fragments of OpenSCManager :

fast path: (here and selected path)

slow path:

fast path:

slow path:

fast path:

slow path:

The issue is that you're trying to pass non-constant scalar values to the datatable operator - that's not supported, regardless of using query parameters or not.

you could replace your usage of the datatable operator with print, for example:

While calling DeviceIOControl(IOCTL_PATH_DELETE), when you pass in szInput and szOutput, you are type-casting a single WideChar to a PWideChar, so whatever numeric value that WideChar contains will be mis-interpreted as a memory address, which is wrong. So you end up passing in invalid memory addresses, which can easily account for the ERROR_NOACCESS error.

Change PWideChar(szInput[0]) to PWideChar(@szInput[0]) or simply get rid of the type-cast altogether, passing @szInput as-is. Same with szOutput.

It is likely that your connection has the engine endpoint instead of the data management endpoint. Can you check that the connection to the cluster starts with "ingest-"? See here an example:

client = KustoIngestClient("https://ingest-{cluster_name}.kusto.windows.net")

Each call to SetServiceStatus() tells the SCM what controls your service is prepared to receive. Likely your last call to SetServiceStatus() set dwControlsAccepted to 0 rather than a mask of reasonable values for a running service (SERVICE_ACCEPT_STOP at the very least).

Update the call where you set dwCurrentState to SERVICE_RUNNING so that dwControlsAccepted includes SERVICE_ACCEPT_STOP.