When running service using shawl with pyinstaller, extracted files are owned by Administrator not designated user

[nkmhor]

I am using shawl to run a python program as a Windows service. The python code is wrapped up into an .exe using pyinstaller. To create the service I execute something like the following from an elevated command (Administrator) prompt:

sc create ServiceName start=auto obj=myuser password="password" binPath = "C:\Users\me\shawl.exe run --cwd d:\wd -- c:\Users\me\python_prog.exe"

The problem is that the files unpacked from python_prog.exe are owned by Administrator and not the myuser specified with sc. One of the files is an Excel spreadsheet and when the python code, running as myuser tries to access the spreadsheet it can't because the spreadsheet is owned by Administrator. Is this a result of shawl or of pyinstaller? The files unpacked by pyinstaller are placed in C:\Users\myuser\AppData\Local\Temp. So if the files are unpacked in myuser by pyth_prog.exe running inside shawl.exe running as myuser, , why aren't they owned by myuser? If I supply a --runtime-temp argument to pyinstaller, then the files are unpacked where I specify but they are still owned by Administrator.

OS: Windows Server 2019 Datacenter
Python: 3.9.5
pyinstaller: 4.7
shawl: 1.1.0

[mtkennerly]

Hi! Shawl doesn't try to assign a user to the service or command, so I don't think this would be because of Shawl, but I'm not sure. Here are some questions to try to narrow it down:

• If you run python_prog.exe manually without a service, who owns the extracted files?
• Try creating a service with shawl.exe run -- C:\tmp\script.cmd, where the script contains echo username is %username%, and then check the Shawl log file to see the output. What does it say?

Unfortunately, I can't test this on my end since I keep getting error 1069 ("The service did not start due to a logon failure") when I try to start a service with a custom obj.

[mtkennerly]

I'm going to close this for now, but I'd be happy to look into this if you get a chance to try out the suggestions above.