tomcat-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From André Warnier>
Subject Re: runtime.exec "cmd.exe /C net use"
Date Sun, 24 Mar 2013 20:01:59 GMT
Patrick Flaherty wrote:
> On Mar 24, 2013, at 2:56 PM, André Warnier wrote:
>> Harris, Jeffrey E. wrote:
>>>> -----Original Message-----
>>>> From: Patrick Flaherty []
>>>> Sent: Sunday, March 24, 2013 12:18 PM
>>>> To: Tomcat Users List
>>>> Subject: Re: runtime.exec "cmd.exe /C net use"
>>>> On Mar 24, 2013, at 10:24 AM, Harris, Jeffrey E. wrote:
>>>>>> -----Original Message-----
>>>>>> From: Patrick Flaherty []
>>>>>> Sent: Sunday, March 24, 2013 10:20 AM
>>>>>> To: Tomcat Users List
>>>>>> Subject: Re: runtime.exec "cmd.exe /C net use"
>>>>>> On Mar 23, 2013, at 10:00 PM, David Kerber wrote:
>>>>>>> On 3/23/2013 8:13 PM, Harris, Jeffrey E. wrote:
>>>>>> Hi,
>>>>>> Thanks for all the input. I know about service logins being only
>>>> able
>>>>>> to use UNC paths (not drive letters) to access network shares. I
>>>> know
>>>>>> the service login & password have to have a matching account
on the
>>>>>> server with the shares in order for the tomcat app to use (access)
>>>>>> those shares. We do all of this. Out tomcat app depends on network
>>>>>> shares to function and it always has worked as long as the service
>>>>>> login account matches an account on the server with the shares.
>>>>>> What I'm trying to do in an html interface is make a pulldown menu
>>>>>> list of my mapped drives as a location for our database backup. It's
>>>>>> a preference setup to where an automated scheduled backup will write
>>>>>> the backups. I'm using "net use" to produce what you would expect
>>>> for
>>>>>> output (all the mapped network drives) and parsing the output to
>>>>>> produce the pulldown menu item containing the unc portion gleaned
>>>>>> from the "net use" output. I need the unc portion as this is what
>>>>>> tomcat app needs. No matter what I do outside the app I cannot
>>>>>> produce the effectively empty list that the app is producing. I'm
>>>>>> logged into Windows as the same account as the service and I open
>>>>>> command prompt and see all my mapped drives via "net use". I have
>>>>>> tried UAC on and off and it changes nothing. I added a simple "dir"
>>>>>> to the app and I can get that output but not the "net use"
>>>>>> output. I do know it has to do with the service as I said because
>>>>>> when tomcat is started via the startup.bat it works great.
>>>>>> Maybe it is a Windows question but thought someone may have had some
>>>>>> similar experience.
>>>>>> Thanks for eveyone's thoughts.
>>>>>> -Pat
>>>>> You still have not answered how the mapping are being made in the
>>>>> first place.  Is the service account dynamically setting the mapping
>>>>> using net use, or through the Windows API?  Are you relying on static
>>>>> mappings in the user account profile?
>>>> Hi Jeffrey,
>>>> The drive mapping are happening through the Windows Explorer interface.
>>>> The file server is browsed and the shares on the file server are mapped
>>>> by right-clicking the share, mapping it to a drive letter and I check
>>>> the checkbox "Reconnect at logon". Then I start my app.
>>>> (I'm not using any user profiles.)
>>>> -Pat
>>>>> Jeffrey Harris
>>> Pat,
>>> I do not think that will work for a service account.  The drive 
>>> mappings are stored in the user profile,
>>> and since I do not think service accounts access user profiles, the 
>>> service account will not remap
>>> the drives when using the account to start a service (it will when 
>>> you actually log in interactively with
>>> the account).  You can try setting some custom environment variables 
>>> in the user profile (not the system profile)
>>> and see if they are accessible by the service account using the set 
>>> command as a test to see if mapping
>>> might be accessible.
>>> What you probably need to do is actually set the drive mappings using 
>>> the Windows API dynamically when Tomcat starts,
>>> or use UNCs.  I know you want to display the drive mappings, but you 
>>> could fake the display by doing a net use >myfilemappings.txt from 
>>> the command line (when logged into the account), and just calling the 
>>> file to display the mappings.  Obviously, if the mappings change, you 
>>> would have to redo the file.
>>> I think those are your only options.  You might want to do a Google 
>>> search and see if there is a way for
>>> service accounts to use remembered mapped drives.
>> I routinely use "net use \\hostname\share" from inside programs 
>> running as Windows Services (not in Java, though, but it should not 
>> matter). "Drive letters" don't work.
>> The exact form I use is :
>> net use \\hostname\sharename <password> /USER:<userid>
>> And then later I can open/read/write/close files as 
>> "\\hostname\sharename\filepath".
>> It works, but I have noticed one "quirk" in my programs : after doing 
>> the "net use", the very first access to the share doesn't work and 
>> returns an error. The second access and all subsequent ones work 
>> though.  I have no idea why this is, but I have just adapted my 
>> programs to work around this issue (by doing a first dummy access and 
>> ignoring the result), and never had any problem since. (**)
>> To be able to do this, the Service *cannot* run as the LocalSystem or 
>> LocalService user. By design in Windows, these special users do not 
>> have access to any "Windows network" functions or resources.  Any 
>> "normal" user (*) will do, depending on the environment (such as, if 
>> the current host is a member of a Windows Domain, and the Windows 
>> network resource is defined in that domain, then the user will need to 
>> be a Domain user; if the resource is a share on a Linux Samba host 
>> e.g., then any user will do, as long as it is known to Samba).
>> This all concerns only "Windows network" resources.  Anything accessed 
>> via standard TCP/IP protocols (HTTP, NFS, FTP, SSL..) works, even when 
>> running as one of these special users.
>> As a not very precise technical definition, "Windows network 
>> resources" are all the things  like "shares" (network directories), 
>> Windows network printers, anything that is accessed via the SMB or 
>> CIFS protocol, anything that requires the usage of a "workgroup" or 
>> "domain" name, etc.
>> (*) with one additional caveat : the user must be granted the "right 
>> to run services".
>> (**) Maybe this is a hint to the OP : what happens if you ignore the 
>> result of the first command call, and try the same command a second 
>> time ?
>> And I agree : there a bit of hocus-pocus here, but then many things 
>> are, in a Windows environment.
> You are not hearing me. The drives are mapped and set to reconnect at 
> logon. Therefore if I reboot my machine the network drive mapping are in 
> place after
> logging in. I *do not* try and map a drive from within my app. My app 
> has full access to the network shares as soon as my app is up. No 
> problem with network
> shares and my app ! 

Well, only if your app is running on your computer though.  As soon as your app is moved 
somewhere else, it will stop working unless you set up that computer the same way.

My app needs to read and write to those network
> share to function and has no problems.
> The problem is after I'm up and running, I try to run "cmd.exe /C net 
> use" from within the app it does not return any mapped drives. it returns:
> net use
> New connections will be remembered.
> There are no entries in the list.
> Again, the return above happen only when running as a service  but works 
> fine when tomcat starts from startup.bat in a console. Works fine means
> it returns drive letter, unc equivalent etc ... basically what you 
> normally see when you have mapped network drives and run "net use" from 
> cmd.exe.
> It make no sense I know but I'm at a loss.
Yes, it does make sense.  When something is running as a Service under a given user-id, it

does not have the same environment as when you login to a computer with that same user-id.
The "service environment" is different from the "interactive login" environment.
In how many ways exactly under Windows, I do not know; but many. (One of the ways is that

a Service does not have a console, while your interactive session does; that alone already

make a lot of programs act differently.  Another way is the permissions, which are 
different between services and interactive users).

The crux of the matter is : if you want your Service (whatever program it runs in whatever

programming language) to have access to certain resources, you should make sure that it is

the service itself which acquires/connect to these resources, and not rely on, for 
example, "mappings" that have been made under another environment, to be present in the 
service environment.

Think of it as follows : when you - personally - login to the machine, you get a "session"

under your user-id. And then inside that session you run Tomcat, as an application, within

that same session.
When a service starts, it does its own login and it gets a different "session", also under

the same user-id, but a different session anyway.
And there is nothing that says that everything that you have in your interactive user 
session is automatically there in that (separate) service session.  And if anything is, it

may just be a bug in this particular Windows version, and may go away at the next version.

To unsubscribe, e-mail:
For additional commands, e-mail:

View raw message