# Credentials' variables blocking beats from running as services on Windows
**URL:** https://discuss.elastic.co/t/credentials-variables-blocking-beats-from-running-as-services-on-windows/214943
**Category:** Beats
**Created:** [January 14, 2020, 8:11am UTC](https://discuss.elastic.co/t/credentials-variables-blocking-beats-from-running-as-services-on-windows/214943 "2020-01-14T08:11:26Z")
**Posts on this page:** 13
**Page:** 1
### Author:  [@jsu](https://discuss.elastic.co/u/jsu)
#### Post date: [January 14, 2020, 8:11am UTC](https://discuss.elastic.co/t/credentials-variables-blocking-beats-from-running-as-services-on-windows/214943/1 "2020-01-14T08:11:26Z")
Hey there,
So, the problem doesn't appear on linux boxes, but only windows ones : win server 2012 and win10. I had the (almost) exact same problem with Winlogbeat, Metricbeat and Filebeat.
Following the documentation concerning [how to configure the output with security activated](https://www.elastic.co/guide/en/beats/winlogbeat/7.5/winlogbeat-configuration.html) and [how to do it securely with a keystore](https://www.elastic.co/guide/en/beats/winlogbeat/7.5/keystore.html), I added the following lines to the config file:
```auto
output.elasticsearch:
hosts: ["myEShost:9200"]
username: "${ES_USER}"
password: "${ES_PWD}"
```
Then I actually store those variables in the keystore of the beat.
Trying to Start-Service [beat\_name] doesn't work, it gives the following error:
```auto
Windows could not start the winlogbeat service on Local Computer.
Error 1053: The service did not respond to the start or control request in a timely fashion.
```
But if I try to run the beats in the foreground with `winlogbeat -e -d "*"`, there's no error and everything runs fine for winlogbeat and filebeat. Metricbeat also seems to run fine with no error, but it stops sending data after a few minutes (still, without any error and seeming to run fine).
If I replace the variables in the config file by the actual usernames and passwords, like this:
```auto
output.elasticsearch:
hosts: ["myEShost:9200"]
username: "actual_username"
password: "actual_password"
```
I can run all the Beats as Services and there's no problem at all.
Am I missing something in the documentation ? Or am I doing something else wrong ?
Looking forward to hearing from you as I really don't know where to go from here.
Thanks in advance !
Cheers,
jsu
---
### Author:  [@jkersey](https://discuss.elastic.co/u/jkersey)
#### Post date: [January 24, 2020, 8:15pm UTC](https://discuss.elastic.co/t/credentials-variables-blocking-beats-from-running-as-services-on-windows/214943/2 "2020-01-24T20:15:58Z")
I also am encountering this exact same issue. It works fine using the test command when the password is in the keystore, but it won't start the service if I use the keystore. it starts the service if I have the password in the yml file.
---
### Author:  [@ilovesteak](https://discuss.elastic.co/u/ilovesteak)
#### Post date: [January 25, 2020, 8:47pm UTC](https://discuss.elastic.co/t/credentials-variables-blocking-beats-from-running-as-services-on-windows/214943/3 "2020-01-25T20:47:20Z")
I'm having the same issue. Extending the timeout for windows services to start doesn't fix it either.
---
### Author:  [@jkersey](https://discuss.elastic.co/u/jkersey)
#### Post date: [January 28, 2020, 7:09pm UTC](https://discuss.elastic.co/t/credentials-variables-blocking-beats-from-running-as-services-on-windows/214943/4 "2020-01-28T19:09:08Z")
So this actually did come down to permissions for me. It was failing to start the service when I attempted to use my normal account with elevated permissions to local administrative.
I was able to use my domain administrator account instead and this took care of it.
I had to open command prompt, use "runas /user:domain.admin@domain.com services.msc" and I was able to successfully start the service. After reboot and logon, the service status returned to "running"
Good luck to everyone else 🙂
---
### Author:  [@jsu](https://discuss.elastic.co/u/jsu)
#### Post date: [January 29, 2020, 1:15pm UTC](https://discuss.elastic.co/t/credentials-variables-blocking-beats-from-running-as-services-on-windows/214943/5 "2020-01-29T13:15:34Z")
Interesting, thanks ! But were you able to run the beats in the foreground before or was it also not working?
I'm also not sure about running beats as domain admin, wouldn't it be a security issue?
---
### Author:  [@jkersey](https://discuss.elastic.co/u/jkersey)
#### Post date: [January 29, 2020, 2:50pm UTC](https://discuss.elastic.co/t/credentials-variables-blocking-beats-from-running-as-services-on-windows/214943/6 "2020-01-29T14:50:55Z")
yes, running beats in the foreground worked, which is why it seemed weird to me that I wasn't able to simply start the service. I did get some help from Elastic (thanks Jason) and was encouraged to check permissions. Running it in the foreground didn't really show me any significant errors that I noticed, and I know that sometimes elevated rights aren't the same as running it as a different user. It seemed like the easiest thing I could try for something that should be straightforward.
I do have questions about running it as my domain admin account, and we'll probably try to set it up using a special "service" account that has the necessary permissions (not sure what those are, so there's still more work to be done). It'll kind of make sense that you don't really want your personal account running it on every computer anyway. furthermore, when you look at the properties for the service, it shows "logon as:" set to "local System account"
---
### Author:  [@jsu](https://discuss.elastic.co/u/jsu)
#### Post date: [February 3, 2020, 8:18am UTC](https://discuss.elastic.co/t/credentials-variables-blocking-beats-from-running-as-services-on-windows/214943/7 "2020-02-03T08:18:04Z")
Thanks a lot for your feedback.
The idea of setting up a special service is very interesting. As you said, the main point issue will be to find what are the minimum permissions necessary for the beats to work.
---
### Author:  [@jkersey](https://discuss.elastic.co/u/jkersey)
#### Post date: [February 3, 2020, 2:59pm UTC](https://discuss.elastic.co/t/credentials-variables-blocking-beats-from-running-as-services-on-windows/214943/8 "2020-02-03T14:59:33Z")
Elastic support suggested that I check the debug logs to see what it didn't have permissions to access. You might need to set the debugging to a different level, such as "debug" in order to really find out.
---
### Author:  [@ferengie](https://discuss.elastic.co/u/ferengie)
#### Post date: [February 28, 2020, 9:34am UTC](https://discuss.elastic.co/t/credentials-variables-blocking-beats-from-running-as-services-on-windows/214943/9 "2020-02-28T09:34:14Z")
I also have this subject.
The command test says - test ok, in an admin shell winlogbeat starts with this configuration, but as a service it doesn't work. I tried to start the service with my credentials - it doesn't work.
Unfortunately the log does not contain anything useful, it seems to be untouched. Maybe there is a problem with different path variables, because the service is configured with explicit paths and in the winlogbeat.yml there are also the paths
what information is drawn?
---
### Author:  [@jsu](https://discuss.elastic.co/u/jsu)
#### Post date: [March 13, 2020, 8:09am UTC](https://discuss.elastic.co/t/credentials-variables-blocking-beats-from-running-as-services-on-windows/214943/10 "2020-03-13T08:09:45Z")
Well, this problem might need a topic of its own. It does seem to be a different problem that we had/have here.
Indeed, starting the service with hard-coded credentials in the config file works fine here. The problem appears when:
- using variables for credentials
- starting the beat as a service
And for the moment, the best solution was provided by @jkersey:
> I had to open command prompt, use "runas /user:domain.admin@domain.com services.msc" and I was able to successfully start the service. After reboot and logon, the service status returned to "running"
---
### Author:  [@MarianaD](https://discuss.elastic.co/u/MarianaD)
#### Post date: [March 18, 2020, 11:03am UTC](https://discuss.elastic.co/t/credentials-variables-blocking-beats-from-running-as-services-on-windows/214943/11 "2020-03-18T11:03:26Z")
@jsu, are you able to list the keys when defined in the keystore?
run for example:
```auto
winlogbeat keystore list
```
You might be encountering the scenario described here: [https://github.com/elastic/beats/issues/12315](https://github.com/elastic/beats/issues/12315), a workaround for this issue is found here [https://github.com/elastic/beats/issues/12315#issuecomment-497777574](https://github.com/elastic/beats/issues/12315#issuecomment-497777574).
---
### Author:  [@jsu](https://discuss.elastic.co/u/jsu)
#### Post date: [March 23, 2020, 3:58pm UTC](https://discuss.elastic.co/t/credentials-variables-blocking-beats-from-running-as-services-on-windows/214943/12 "2020-03-23T15:58:06Z")
@MarianaD I can't thank you enough, you were completely right. I was encountering this exact scenario and managed to get it fixed thanks to your links. Thank you so much!
So, for information for people who don't want to check the Github links: this is a problem in where the Beats look for the keystore. Indeed, the Beats look for data in `C:\ProgramData\xxxbeat` and the keystore is created by default in `C:\Program Files\xxxbeat\data`. Solution is either to copy the keystore in the right location (ProgramData), either to create it directly there.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 20, 2020, 5:58pm UTC](https://discuss.elastic.co/t/credentials-variables-blocking-beats-from-running-as-services-on-windows/214943/13 "2020-04-20T17:58:11Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.