Minimum OS Permissions required to create named pipe (WCF)

Question

I have an exe that runs under the context of the logged-in user. The exe uses WCF to make itself a named pipe server (it will be called by multiple clients).

Does the user need a specific permission for the exe to be able to create the named pipe? I've tried running as a user with fairly minimal permissions (i.e. just in the local Users group), and this works fine - but I'm concerned that when I deploy to the clients site, the users may be limited in some way that means the named pipe creation doesn't work.

Answer 1

No special permissions are required for a locally logged on user to set up the service end of a WCF service using the netNamedPipe binding.

However, you do need to worry about whether the clients can find and connect to the service. There are two aspects to this:

1. The clients must be running in a security context which is not established by a network logon (such as impersonation of a remote user in a web application). This is because WCF denies access to any logon which is a member of the NETWORK USERS group.
2. If you are running on Vista or Windows7, the service exe will need to be running with the privilege SeCreateGlobalPrivilege if you want the service to be accessible to clients running outside the logged on user's session. This is because the WCF service needs to publish the pipe name to a shared memory object to enable clients to find it: if the WCF service stack can create this shared memory object in the Global namespace (visible to all logon sessions), it will. But if it does not have the necessary privileges, it creates the shared memory object in the Local namespace (visible only within the same logon session). Deploying the WCF service as a Windows service is the only easy way to get it running with this privilege and thus visible to clients outside its session.

More details here if you are interested.