I have a Windows service that performs some network-related actions on behalf of the logged-in user who configures the service using a separate front-end UI. The UI and the Windows service communicate using a socket interface, i.e., the UI sends commands to the service, and the service sends data to the UI for processing/display. This setup has worked for us for years.
Recently, security policy mandated that our Windows service could no longer run as LocalSystem, but instead had to run as LocalService. For the most part, this has been an uneventful change. However...
Part of the Windows service functionality is to create a log file at the user-specified location and write data to that log file until the user tells it to stop. If the user specifies a directory at the C:\ level (e.g., C:\MyLogs), the Windows service works fine. But if the user specifies a directory in her MyDocuments folder (e.g., C:\Users\<username>\Documents\MyLogs), the Windows service fails with a System.UnauthorizedAccessException saying that
Access to <location> is denied.
It took me a while, but I finally understand that the Windows service running as LocalService does not have access to the logged-in user's profile folders, e.g., MyDocuments, AppData, etc.
Is there a workaround for this?
There are a few options that come to mind, but as I'm not proficient when it comes to Windows security, my Google ninja skills are woefully weak given that I'm not exactly sure what to search for. Here are a couple of specific questions I have. I would appreciate any guidance the community can provide.
- Is there a way for the Windows service to impersonate the logged-in user account so that it can create the directories and files as if the user were doing it directly?
- Is it possible to add permissions to the user's profile folders such that the LocalService account can create the directories and files there?