# EXE works, service doesn't (Socket permissions)

**URL:** <https://discuss.elastic.co/t/exe-works-service-doesnt-socket-permissions/113431>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [December 28, 2017, 9:56am UTC](https://discuss.elastic.co/t/exe-works-service-doesnt-socket-permissions/113431 "2017-12-28T09:56:16Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![JRSol](https://avatars.discourse-cdn.com/v4/letter/j/f9ae1b/32.png) [@JRSol](https://discuss.elastic.co/u/JRSol)\
**Post date:** [December 28, 2017, 9:56am UTC](https://discuss.elastic.co/t/exe-works-service-doesnt-socket-permissions/113431/1 "2017-12-28T09:56:16Z")

</div>

Hi folks,

Winlogbeat is working wonderfully when I start the exe, with all the features I need, such as SSL, but when I try to run it as a service it fails.

I've then collected some logs and it seems the service is lacking permissions to access the socket.  
Unfortunately, our hoster set the language to german, so the error is in german as well:

ERR Failed to connect to \*\*\*\*: connectex: Der Zugriff auf einen Socket war aufgrund der Zugriffsrechte des Sockets unzulässig

I'm gonna add that this is a server that is restricted with firewall rules pretty heavily, but I have created rules to allow communication on the exe as well as on the service.

Anybody ran into this problem? It seems to me you'd have to allow the service to communicate over the network?

Cheers,  
JR

---

<div class="post-metadata">

**Author:** ![JRSol](https://avatars.discourse-cdn.com/v4/letter/j/f9ae1b/32.png) [@JRSol](https://discuss.elastic.co/u/JRSol)\
**Post date:** [December 28, 2017, 10:16am UTC](https://discuss.elastic.co/t/exe-works-service-doesnt-socket-permissions/113431/2 "2017-12-28T10:16:58Z")

</div>

okay, I can already tell it's the firewall.  
I'll post when I find out which user/service/whatever I have to allow in the firewall.

Thought it would be pretty foolproof with the service rule, but apparently not.

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [January 2, 2018, 4:12pm UTC](https://discuss.elastic.co/t/exe-works-service-doesnt-socket-permissions/113431/3 "2018-01-02T16:12:28Z")

</div>

Either I haven't seen this error or it doesn't not translate close enough to the English error that I recognize it. Perhaps @maddin2016 has some insight.

On a related not I would like to improve the installation process to better handle a lot of the common issues people encounter such as firewall rules.

---

<div class="post-metadata">

**Author:** ![JRSol](https://avatars.discourse-cdn.com/v4/letter/j/f9ae1b/32.png) [@JRSol](https://discuss.elastic.co/u/JRSol)\
**Post date:** [January 2, 2018, 4:19pm UTC](https://discuss.elastic.co/t/exe-works-service-doesnt-socket-permissions/113431/4 "2018-01-02T16:19:52Z")

</div>

Hi @andrewkroh,  
meanwhile I have (kind of) solved it:

In the properties of a service you can specify what user to run it under. Set this, modify firewall rule to allow that user, done.

if you put just the exe into the rule it will not work and for some reason specifying the service name does not work either in my case.

So I guess there's some work to be done on the install-as-service script.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 30, 2018, 4:20pm UTC](https://discuss.elastic.co/t/exe-works-service-doesnt-socket-permissions/113431/5 "2018-01-30T16:20:07Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.