How do I run Tomcat service as a specific user in Windows?

Question

I needed to do this so that Tomcat could take advantage of some Active Directory stuff, and it took a lot of searching to get all the niggly bits sorted. Hopefully if I answer my own question here, it will save others some trouble.

• How do I run Tomcat 7/8/N as a service?
• How do I tell the TomcatN service which user to log in as?
• How do I give a user permissions?

Solution

When entering commands, you should do so as Administrator. E.g. from Windows start menu, type in cmd, right click on the cmd.exe or Command Prompt it gives you, and select Run as administrator.

Install TomcatN as a service:

Just run tomcat's c:\path\to\TomcatN\bin\service.bat and give it a service name to use, i.e. Tomcat8. Or,

sc Create TomcatN binPath= "c:\path\to\TomcatN\bin\tomcatN.exe" displayName= "Apache Tomcat N"

Set the service to run as a specific user:

Most of the time you don't need this. But sometimes you need to access the Windows network as a registered user. For example, if you are taking advantage of some Active Directory functionality. It might work to use the following:

C:\path\to\tomcatN\bin\service.bat install TomcatN --user=George --password=abc123

But probably not. You can configure the service manually instead.

Manually configure the service to use a specific username and password:

From the Windows command prompt, you can use the services configurator. Some commands of interest:

sc
sc query TomcatN
sc qc TomcatN
sc config TomcatN obj= "MyHostName\George" password= "abc123"

Take care to note the space that comes after the equal signs in that last command.

Ensure the user has permissions:

Enter the gpedit.msc command. In the GUI that appears, navigate to

Local Computer Policy                  | ...
    - Computer Configuration           | ...
        - Windows Settings             | []Log on as a service
            - Security Settings        | ...
                User Rights Assignment | ...

Double-click on Log on as a service and Add User or Group.... Type the shorthand for the username you want the service to use into the field, click Check Names, and press OK.

Confirm that TomcatN is running as intended:

You can use the following commands to start, stop, and check the status of the service:

net start TomcatN
net stop TomcatN
sc query TomcatN

Checking that the login works as intended

Make sure you've started the service running. Open Windows Task Manager and view the Processes tab. Click on Show processes from all users if necessary. TomcatN should be listed, with the username you specified next to it.