3

I needed to do this so that Tomcat could take advantage of some Active Directory stuff, and it took a lot of searching to get all the niggly bits sorted. Hopefully if I answer my own question here, it will save others some trouble.

  • How do I run Tomcat 7/8/N as a service?
  • How do I tell the TomcatN service which user to log in as?
  • How do I give a user permissions?

2 Answers 2

6

When entering commands, you should do so as Administrator. E.g. from Windows start menu, type in cmd, right click on the cmd.exe or Command Prompt it gives you, and select Run as administrator.

Install TomcatN as a service:

Just run tomcat's c:\path\to\TomcatN\bin\service.bat and give it a service name to use, i.e. Tomcat8. Or,

sc Create TomcatN binPath= "c:\path\to\TomcatN\bin\tomcatN.exe" displayName= "Apache Tomcat N"

Set the service to run as a specific user:

Most of the time you don't need this. But sometimes you need to access the Windows network as a registered user. For example, if you are taking advantage of some Active Directory functionality. It might work to use the following:

C:\path\to\tomcatN\bin\service.bat install TomcatN --user=George --password=abc123

But probably not. You can configure the service manually instead.

Manually configure the service to use a specific username and password:

From the Windows command prompt, you can use the services configurator. Some commands of interest:

sc
sc query TomcatN
sc qc TomcatN
sc config TomcatN obj= "MyHostName\George" password= "abc123"

Take care to note the space that comes after the equal signs in that last command.

Ensure the user has permissions:

Enter the gpedit.msc command. In the GUI that appears, navigate to

Local Computer Policy                  | ...
    - Computer Configuration           | ...
        - Windows Settings             | []Log on as a service
            - Security Settings        | ...
                User Rights Assignment | ...

Double-click on Log on as a service and Add User or Group.... Type the shorthand for the username you want the service to use into the field, click Check Names, and press OK.

Confirm that TomcatN is running as intended:

You can use the following commands to start, stop, and check the status of the service:

net start TomcatN
net stop TomcatN
sc query TomcatN

Checking that the login works as intended

Make sure you've started the service running. Open Windows Task Manager and view the Processes tab. Click on Show processes from all users if necessary. TomcatN should be listed, with the username you specified next to it.

0

service.bat no longer supports the --password parameter, but running sc config as described above to change the account works fine. I also tried using RunAs and creating a scheduled task but couldn't get either method to work.

The service account also needs permission to access to the tomcat directory so it can read its own files and write logs, but internet services should never be allowed to update themselves otherwise they are vulnerable. Also permission to access any other directory providing input and receiving output from the tomcat application.

icacls directory-containing-input-to-tomcat /grant "the-service-account:(OI)(CI)R" /T
icacls directory-receiving-output-tomcat /grant "the-service-account:(OI)(CI)W" /T

To grant 'Log on as a service' via the command line, use ntrights.exe instead of gpedit.msc. I found ntrights.exe in rktools.msi containing Windows Server 2003 Resource Kit Tools.

ntrights.exe +r SeServiceLogonRight -u "the-service-account"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.