title: Windows Service user account trouble for TFSBuildServiceHost.exe
body: <p>Experienced a very strange problem today on our TFS2010 build server. Suddenly the build service failed for no apparent reason. We´re been trouble shooting it all day, but still haven´t found the reason yet. </p>
  
  <p>One of the problems is that the build service is (or should!) running under an AD user called tfs2010build. However when I try to start the service, i get the following error</p>
  
  <pre><code>Service cannot be started. Microsoft.TeamFoundation.TeamFoundationServerUnauthorizedException: TF30063: You are not authorized to access http://tfs2010:8080/tfs/default. ---&gt; System.Net.WebException: The remote server returned an error: (401) Unauthorized.
  </code></pre>
  
  <p>When I look in the event log on the TFS2010 server, I see that the failed  authentication is registered for a user called TFS2010Install, which was used to install everything. I´ve tripple checked and the service is specified as to be running under TFS2010Build. </p>
  
  <p>Log from TFS2010 server:</p>
  
  <pre><code>Account For Which Logon Failed:
  Security ID:        NULL SID
  Account Name:       TFS2010INSTALL
  Account Domain:     LC
  </code></pre>
  
  <p>So my question is how is this possible. COuld the user TFS2010Build some how be impersonated by TFS2010Install? I
  ve tried to install an additional build server and here there´s no problem starting the service under the user TFS2010Build - hence it is not a problem with AD or TFS user rights. </p>
  
  <p>Hope you guys can help out!</p>
  
  <p>/Jasper</p>
  
  <p>!! Updated with some screen shots. Build server is TFS2010BIULD and the TFS server is TFS2010
  <img src="https://i.stack.imgur.com/GDvw7.png" alt="enter image description here"></p>
  
  <p><a href="https://i.stack.imgur.com/GDvw7.png" rel="noreferrer">Link to full size</a></p>
  
  <p>Screen shot of non working build server TFS2010Build
  <img src="https://i.stack.imgur.com/UONXM.png" alt="enter image description here"></p>
  
  <p>Screen shot of working build server TFS2010Build1
  <img src="https://i.stack.imgur.com/8eL85.png" alt="enter image description here"></p>
  
  <p>!!New Update</p>
  
  <p>I've managed to get the Build service to run under the TFS2010Build user account (which was actually the initial state, when the problem started). When I queue builds to this controller and agent, i get the follwing in the build log:</p>
  
  <blockquote>
    <p>TF215097: An error occurred while initializing a build for build definition \PlanteIT_MarkOnline_Scrum\CI_Main_FieldOnlineClient: TF215106: Access denied. LC\TFS2010INSTALL needs Update build information permissions for build definition CI_Main_FieldOnlineClient in team project PlanteIT_MarkOnline_Scrum to perform the action. For more information, contact the Team Foundation Server administrator.</p>
  </blockquote>
  
  <p>It still insist that TFS2010Install user account is running the service, despite that TFS2010Build is used for the build service. Any ideas?</p>