Home distributed transactions microsoft technologies networking software development

NetworkService Account: MSDTC's Go-To for App Devs

Updated: • 0 • min read
Table of Contents

NetworkService Account: Your MSDTC’s Best Friend!

Hey App Devs! Ever wrestled with MSDTC (Microsoft Distributed Transaction Coordinator)? It’s a crucial service, but can be a bit tricky. One key thing is making sure it’s running under the right Windows account: the NT AUTHORITY\NetworkService. Let’s dive in and figure out why this is so important and how to set it up right.

NetworkService Account
image just illustration

Why NetworkService is the Chosen One

On all Windows versions, from client PCs to powerful servers, MSDTC needs to be buddies with the NetworkService account. If you try to use a different account, your distributed transactions will likely fail. Why? Because MSDTC needs to authenticate with other parts of your system involved in the transaction, and it can only do that reliably with NetworkService. Even local transactions that use MSDTC can go haywire if you change this setting. Think of it as a VIP pass for MSDTC.

MSDTC
image just illustration

The NetworkService Lowdown (especially for Windows XP and Server 2003)

Back in the days of Windows NT 4.0 and Windows 2000, you had some flexibility with the MSDTC service account. You could even switch it to a domain account for special scenarios like XA recovery operations on databases like Oracle. However, with Windows XP and Server 2003, things changed. NetworkService became the account to use, no exceptions.

If you need to perform an XA recovery, you can’t just change the account. Instead, you have to grant the necessary permissions and roles directly to the NetworkService account on the machine running MSDTC. This usually involves adding the computer’s account (where MSDTC lives) to the user list authorized for XA recovery on the database. Also, because NetworkService has limited access, you’ll need to give it access to the folder where the XA DLL file resides. The specifics of this setup will depend on your database software.

Restarting the MSDTC Service (All Windows Versions)

Sometimes you might need to restart MSDTC to apply changes. Here’s the general process, but remember, some steps might vary slightly depending on your Windows version:

  1. Open Command Prompt as Administrator:

    • Windows 8 and 8.1: Search for cmd on the Start screen, then right-click “Command Prompt” and choose “Run as administrator.”
    • Windows 7 and earlier: Press Windows Key + R, type cmd, press Enter, then right-click “cmd” and choose “Run as administrator.”

  2. Stop MSDTC: Type net stop msdtc and press Enter.

  3. Start MSDTC: Type net start msdtc and press Enter.

  4. Open Component Services: Click Start, then Run, type dcomcnfg.exe, and click OK.

  5. Navigate to My Computer: Expand “Component Services,” then “Computers,” and finally “My Computer.”

  6. Open My Computer Properties: Right-click “My Computer” and select “Properties.”

  7. MSDTC Security Configuration: Click the “MSDTC” tab, then click “Security Configuration.”

  8. Set the Logon Account: Change the account under “DCT Logon Account” to NT AUTHORITY\NetworkService. If it asks for a password, leave it blank.

  9. Apply Changes: Click OK twice to save your settings.

Restoring NetworkService Account in Windows XP and Server 2003 (Registry Edit)

This involves modifying the registry, so proceed with caution! Incorrect changes can cause problems. Always back up your registry before making any edits.

  1. Open Registry Editor: Click Start, Run, type regedit, and click OK.

  2. Navigate to MSDTC Key: Find this key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSDTC

  3. Create Registry Entries (If they don’t exist): Create three DWORD values named TurnOffRpcSecurity, AllowOnlySecureRpcCalls, and FallbackToUnsecureRPCIfNecessary.

  4. Set Entry Values:
    * TurnOffRpcSecurity: Set to 1.
    * AllowOnlySecureRpcCalls: Set to 0.
    * FallbackToUnsecureRPCIfNecessary: Set to 0.

  5. Restart MSDTC: Follow the steps mentioned earlier to restart the MSDTC service.

  6. Verify NetworkService Account: Double-check the Component Services settings (as described above) to ensure the “DCT Logon Account” is set back to NT AUTHORITY\NetworkService.

Key Takeaways and Next Steps

Making sure your MSDTC service runs under the NetworkService account is essential for smooth distributed transactions. While older Windows versions offered more flexibility, sticking with NetworkService is the best practice from Windows XP and Server 2003 onwards. By following the steps outlined above, you can configure your system correctly and avoid headaches down the road.

Now, I’d love to hear from you! Have you encountered any MSDTC challenges? Share your experiences and questions in the comments below. Let’s learn together! And do come back again if you crave more tech insights!

Post a Comment