Article ID: 5498, created on Jul 25, 2008, last review on Aug 12, 2014

  • Applies to:
  • Virtuozzo containers for Windows 4.0

Symptoms

As part of the Virtuozzo installation “Log on as a service” right is added to vzagent account.
If Virtuozzo server is member of Active Directory domain or domain controller it inherits domain policy. Default domain policy excludes vzagent user from local security policy "Log on as a service".
As consequent result management tools (PMC, PIM) cannot connect to Virtuozzo host.

Resolution

To add the "Log on as a service" right to vzagent account on stand alone server:
    
1. Open Local Security Policy.
2. In the console tree, double-click Local Policies, and then click User Rights Assignments.
3. In the details pane, double-click Log on as a service.
4. Click Add User or Group, and then add the vzagent account to the list of accounts that possess the Log on as a service right.
    
To add the "Log on as a service" right to vzagent account for a Group Policy object, when you are on server that is joined to a domain:
    
1. Click Start, point to Run, type mmc, and then click OK.
2. On the File menu, click Add/Remove Snap-in.
3. In Add/Remove Snap-in, click Add, and then, in Add Standalone Snap-in, double-click Group Policy Object Editor.
4. In Select Group Policy Object, click Browse, browse to the Group Policy object (GPO) that you want to modify, click OK, and then click Finish.
5. Click Close, and then click OK.
6. In the console tree, click User Rights Assignment.

 Where:

  • GroupPolicyObject [ComputerName] Policy
  • Computer Configuration
  • Windows Settings
  • Security Settings
  • Local Policies
  • User Rights Assignment

7. In the details pane, double-click Log on as a service.
8. If the security setting has not yet been defined, select the Define these policy settings check box.
9. Click Add User or Group, and then add the vzagent account to the list of accounts that possess the Log on as a service right.

To add the "Log on as a service" right to vzagent account for a Group Policy object, when you are on a domain controller or on a computer that has the Windows Server 2003 Administration Tools Pack installed:
    
1. Open Active Directory Users and Computers.
2. In the console tree, right-click the domain or organizational unit (OU) for which you want to edit security settings.
3. Click Properties, and then click the Group Policy tab.
4. In Group Policy Object Links, click the Group Policy object for the domain or OU for which you want to edit security settings, and then click Edit.
5. In the console tree, click User Rights Assignment.

 Where:

  • GroupPolicyObject [ComputerName] Policy
  • Computer Configuration
  • Windows Settings
  • Security Settings
  • Local Policies
  • User Rights Assignment

6. Double-click Log on as a service in the details pane.
7. If this security setting has not yet been defined, select the Define these policy settings check box.
8. Click Add User or Group, and then add the appropriate account to the list of accounts that possess the Log on as a service right.

To add the "Log on as a service" right to vzagent account for only domain controllers, when you are on a domain controller:
    
1. Open Domain Controller Security Policy.
2. In the console tree, click User Rights Assignment.

 Where:

   • Security Settings
   • Local Policies
   • User Rights Assignment

3. In the details pane, double-click Log on as a service.
4. If this security setting has not yet been defined, select the Define these policy settings check box.
5. Click Add User or Group, and then add the vzagent account to the list of accounts that possess the Log on as a service right.

AdditionalInformation

1. This article was created based on Microsoft KB artice:
http://technet2.microsoft.com/windowsserver/en/library/be1ebd3f-3490-4fb6-9558-16b6b49b89ba1033.mspx?mfr=true

2. Active Directory domain policy can also affect WSUS settings on Virtuozzo server.
This is a recommended article to be able to verify correct WSUS settings:
http://kb.sp.parallels.com/en/1748

28d0f7cc091e3b9304fa556c03f9a940 965b49118115a610e93635d21c5694a8 d02f9caf3e11b191a38179103495106f 2897d76d56d2010f4e3a28f864d69223

Email subscription for changes to this article
Save as PDF