How to configure Office applications to run under the interactive user account (288366)

MORE INFORMATION

Caution Automation of any Office application from an unattended, non-interactive user account is risky and unstable. A single error in code or configuration can result in a dialog box that can cause the client process to stop responding (hang), that can corrupt data, or that can even crash the calling process (which can bring down your Web server if the client is ASP).

Warning Office was not designed, and is not safe, for unattended execution on a server. Developers who use Office in this manner do so at their own risk.

Regardless, it may absolutely required to use Office in this manner. In these cases, special configuration must be done to avoid errors on Office startup. The steps in this article demonstrate how to configure Office to run as the interactive user account when it is started for Automation.

When you automate under the interactive user account, you should be aware of the following problems:

• Normally, the Interactive User is defined as the the user that is logged on to the local console (that is, the user who is physically at the computer). On computers that use Microsoft Windows 2000 Terminal Services or Microsoft Windows XP Terminal Services, the Interactive User is defined as a user who is logged on to the local console or a user who is connected to the computer through a remote Terminal Server client.
• When it is started through automation, the Office application always runs under the security context of the user that is doing the automation. If the user is logged on to the server locally, the application runs under that user context. If a user is connected through a Terminal Server session, the application runs under that user account.
  
  Note If you have multiple Terminal Server connections, the application runs under the context of each user who is logged on.
• When the Office application is started from a user context that does not have interactive privileges (such as the SYSTEM account), a user must be logged on to the server at the local console, regardless of whether Terminal Services is being used, otherwise an error occurs and the application does not start.
  
  The following table shows some scenarios you may experience when an Office application is configured to run as the Interactive User:

  Programming Action	Logged On at Local Console?	Results
  Programmatically create an instance of the application from a user session logged on the machine remotely through a Terminal Server Client	Yes	Success: The application starts under the desktop of the local or remote user that is running the Automation code.
  	No	Success: The application starts under the desktop of the remote user that is running the Automation code.
  Programmatically create an instance of the application from an account with a non-interactive SID (ASP, Service, etc.)	Yes	Success: The application starts under the desktop of the user that is logged on locally (the user that is physically at the machine).
  	No	Error: 0x8000401A - CO_E_RUNAS_LOGON_FAILURE The server process could not be started because the configured identity is incorrect. Check the username and password.
  Programmatically create an instance of the application from an MTS/COM+ package that is configured to run as INTERACTIVE	Yes	Success: The application starts under the desktop of the user that is logged on locally. Terminal Server sessions are not "interactive" in this case.
  	No	Error: 0x8000401A - CO_E_RUNAS_LOGON_FAILURE The server process could not be started because the configured identity is incorrect. Check the username and password.
  Programmatically create an instance of the application from an MTS/COM+ package that is configured to run as a specific user	Yes	Success: The application starts under the desktop of the user that is logged on locally, and not the specific user account for the package.
  	No	Error: 0x8000401A - CO_E_RUNAS_LOGON_FAILURE The server process could not be started because the configured identity is incorrect. Check the username and password.

Because the changes in DCOM are global, configuring Office in this manner can have negative side effects for other clients on the system that use Office. It is possible that another client application will not be able to use the Office application after the settings are made. Consider carefully what impact this has to your server before you make any changes to the DCOM configuration settings.

If the problems listed here are too great for your design, or cause other unidentified problems, it is possible to configure Office differently and still allow it to start from an unattended process or service. For more information, click the following article numbers to view the articles in the Microsoft Knowledge Base:

Configuring Office as the interactive user

To set up an Office Automation server under the interactive user account, follow these steps:

1. Log on to the computer as the Administrator and install (or reinstall) Office using a complete install. For system robustness, it is recommended that you copy the contents of the Office CD-ROM to a local drive and install Office from this location.
2. Start the Office application that you intend to automate. This forces the application to register itself.
3. After the application is running, press ALT+F11 to load the Microsoft Visual Basic for Applications (VBA) editor. This forces VBA to initialize itself.
4. Close the applications, including VBA.
5. Click Start, click Run, and then type DCOMCNFG. Select the application that you want to automate. The application names are listed below:

   Microsoft Access 97 - Microsoft Access Database
   Microsoft Access 2000/2002 - Microsoft Access Application
   Microsoft Excel 97/2000/2002 - Microsoft Excel Application
   Microsoft Word 97 - Microsoft Word Basic
   Microsoft Word 2000/2002 - Microsoft Word Document

   Click Properties to open the property dialog box for this application.
   
   
6. Click the Security tab. Verify that Use Default Access Permissions and Use Default Launch Permissions are selected.
7. Click the Identity tab and then select The Interactive User.
8. Click OK to close the property dialog box and return to the main applications list dialog box.
9. In the DCOM Configuration dialog box, click the Default Security tab.
10. Click Edit Defaults for access permissions. Verify that the following users are listed in the access permissions, or add the users if they are not listed:

    SYSTEM
    INTERACTIVE
    Everyone
    Administrators
    IUSR_<machinename>*
    IWAM_<machinename>*
    
    * These accounts only exist if Internet Information Server (IIS) is installed on the computer.

11. Make sure that each user is allowed access and click OK.
12. Click Edit Defaults for launch permissions. Verify that the following users are listed in the launch permissions, or add the users if they are not listed:

    SYSTEM
    INTERACTIVE
    Everyone
    Administrators
    IUSR_<machinename>*
    IWAM_<machinename>*
    
    * These accounts exist only if IIS is installed on the computer.

13. Make sure that each user is allowed access, and then click OK.
14. Click OK to close DCOMCNFG.
15. Start REGEDIT and verify that the following keys and string values exist for the Office application that you want to automate:

    Microsoft Access 2000/2002:
    Key: HKEY_CLASSES_ROOT\AppID\MSACCESS.EXE
    AppID: {73A4C9C1-D68D-11D0-98BF-00A0C90DC8D9}
    
    Microsoft Access 97:
    Key: HKEY_CLASSES_ROOT\AppID\MSACCESS.EXE
    AppID: {8CC49940-3146-11CF-97A1-00AA00424A9F}
    
    Microsoft Excel 97/2000/2002:
    Key: HKEY_CLASSES_ROOT\AppID\EXCEL.EXE
    AppID: {00020812-0000-0000-C000-000000000046}
    
    Microsoft Word 97/2000/2002:
    Key: HKEY_CLASSES_ROOT\AppID\WINWORD.EXE
    AppID: {00020906-0000-0000-C000-000000000046}
    
    

    If these keys do not exist, you can create them by running the following .reg file on your system:

    REGEDIT4
    
    [HKEY_CLASSES_ROOT\AppID\WINWORD.EXE]
    "AppID"="{00020906-0000-0000-C000-000000000046}"
    
    [HKEY_CLASSES_ROOT\AppID\EXCEL.EXE]
    "AppID"="{00020812-0000-0000-C000-000000000046}"
    
    [HKEY_CLASSES_ROOT\AppID\MSACCESS.EXE]
    "AppID"="{73A4C9C1-D68D-11D0-98BF-00A0C90DC8D9}"
    					

    Note The sample .reg file is for Access 2000 or Access 2002. If you are using Access 97, change the AppID key to:

    "AppID"="{8CC49940-3146-11CF-97A1-00AA00424A9F}"

16. Restart the system. This is required.