Can't run a service under an account which has no password?

winapi, windows-services

Solution

By default all modern versions of Windows have a Local Security policy that restricts users with blank passwords to logging on at the local console only. In other words, a user with a blank password must physically be at the computer in order to log on. The user cannot log on as a service, as a batch user, over a network, etc.

This can be changed by changing the policy under Local Policies -> Security Options. Or by changing the LimitBlankPasswordUse value under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa to zero.

But, and this is very important, this will set up a serious hole in your security since users with blank passwords will now be able to log on remotely and blank passwords are pretty easy to guess. I can't think of any reason to have a service run under an account with no password, so my recommendation would be - don't do it.

Problem

I can start the service correctly if the service's "Log on" account has a password. But when I remove the user password and try again, I got the error: "Error 1069: The service did not start due to a logon failure" Can't a service runs under an account with empty password?

Original source