SNA Services Fail to Start Due to Logon Failure (262377)

SYMPTOMS

When you restart a computer running SNA Server, the SNABase service or SNAServer service may fail to start with the following Event ID:

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7000
Date:		5/8/2000
Time:		2:15:54 AM
User:		N/A
Computer:       <servername>
Description:
The SNABase service failed to start due to the following error: The service did not start due to a logon failure.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7013
Date:		5/8/2000
Time:		2:15:54 AM
User:		N/A
Computer:       <servername>
Description:
Logon attempt with current password failed with the following error: 
Logon failure: unknown user name or bad password.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7000
Date:		5/8/2000
Time:		3:07:21 AM
User:		N/A
Computer:       <servername>
Description:
The SnaServer service failed to start due to the following error: 
The service did not start due to a logon failure.

When you attempt to start the services manually in Control Panel Services, one of the following error messages may occur:

Could not start the SNABase service on this local computer.
Error 2140: An Internal Windows NT error occurred.

Could not start the SNABase service on this local computer.
Error 1069: The service did not start due to logon failure.

Could not start the SNAServer service on this local computer.
Error 1069: The service did not start due to logon failure.

CAUSE

When you install SNA Server, a domain system account is created that is used by the SNA Server services to gain authority to start. Since the time when the account was created, the following scenarios may have occurred to cause this problem:

The domain system account no longer exists in the domain specified in the SNA Server service startup properties.
The password has been changed for the SNA Server service domain system account.
The SNA Server service domain account resides in a separate domain that is a trusted domain of the current domain where the SNA Server system resides. The trust relationship between these two domains is currently broken.
The user rights for the SNA Server service domain system account have been altered.

WORKAROUND

In Control Panel Services, configure the SNA Server services that are using a domain system account to use the local System Account. This allows the services to be stopped and started with authentication by the Local System Account (LSA) authority.

NOTE: Remote management from the SNA Server Manager or the SNA Server Microsoft Management Console (MMC) snap-in is hindered by using this workaround. SNA Server remote management requires a domain system account that uses the Windows NTLM Security Support Provider (NTLMSSP) authority. Also, the SNA Server Print service may require NTLMSP to print to remote printer queues.

MORE INFORMATION

During the installation of SNA Server is when the SNA domain system account can be created. This account has Domain Admin rights and Advanced User rights both. For full functionality of the SNA Server services and resources, the following Advanced User rights must be granted to the SNA Server domain system account to allow the SNA Server services to log on outside of the Domain Admin group:

Act as part of the Operating SystemLogon as a ServiceGenerate Security AuditsLoad and Unload Device DriversManage Audit and Security Log