Ah, good results.

msiserver, bits and wuauserv run under the LocalSystem account.
cryptsvc runs under your own user account.

Therefore it seems to me the problem is not specifically with msiserver but rather something in your system is preventing Sandboxie from running programs under the LocalSystem account.

I don't know if a Windows update is responsible for that. I'd look more into any other security software that you use.

Some other services running from the Local System account can also be started fine. SharedAccess and Netlogon for example. The security software I use didn't change nor their settings and it did already work with them.

On my systems the cryptsvc is configured to start under the local system account like all the others, isn't that the default?

Any other way for me to narrow down the cause of this logon problem?

Why are we talking about services in general? SharedAccess and Netlogon don't run in the sandbox so why bring them up.

Under the sandbox, CryptSvc (SandboxieCrypto) runs under your standard user account. The others, including MSIServer, all run with SYSTEM privileges. And you were able to start CryptSvc but not any of the others.

So again I am saying that apparently you can't get programs in the sandbox to run under LocalSystem. I am not sure why. For example one possible scenario: At some point, your security software popped a question that SbieSvc.exe is trying to run a program under LocalSystem, and you blocked it.

Or maybe you enabled Drop Rights in Sandboxie and then you hid the messages that inform you that a service was blocked due to dropped rights.

You probably think these are silly examples, and maybe they are, but my point is the most likely reason for this problem is that something is preventing Sandboxie from running programs under LocalSystem.

You are right those services are not relevant because they are not started inside the sandbox. Hadn't thought about that, sorry.

Aside from my effort to find the cause of this issue I guess that's the end of it for now. I went back and checked on my other system which is running a very static overall configuration except for individual software updates for security fixes and Windows Updates and it has the same problem. It's just no good continuing unless someone with a fresh idea chimes in.

Thank you for your support so far.

Well, in case you're still around and still willing to experiment with this:

Another question I have is whether the service programs start in the sandbox when you do "net start". I.e. do they start and immediately fail. Or do they not start at all.

So suppose you do "net start bits", do you see SandboxieBITS.exe appearing in Sandboxie Control?

Except for cryptsvc which starts successfully sandboxed right away all show the same behavior. Bits, wuauserv and msiserver launch a Start.exe child process under SbieSvc.exe. After approximately 30 seconds the error message about the logon is being displayed. That's all. The Start.exe's will just sit there until I kill them.

I see. In this case, would you mind using the windbg debugger on that Start.exe to see where it is stuck?

I have some detailed instructions for doing this here:

http://www.sandboxie.com/index.php?HowToUseWinDbg

You obviously want scenario 2 from that page, i.e. attach the debugger to a running program.

Hopefully this is the correct output:




The Start.exe command-line: "C:\Program Files\Sandboxie\Start.exe" /model:1236:\Sessions\0\DosDevices\00000000-0003064e: C:\WINDOWS\system32\msiexec.exe /V

The debug log was done correctly. But it suggests you're still using version 3.46. When people keep using version 3.46 even in the face of problems, that tells me something. Anyway, my mistake for not asking the version number, and I certainly paid for that mistake with my time. Obviously, you should upgrade to the latest version.

I am sorry having wasted your time then. Yes I use version 3.46 because it is working perfectly fine otherwise.
The reason I did not update is the introduced requirement to reactivate after X period of time which would be a first for any software I ever used to be reactivated just because time has passed. Should the terms of the activation finalize and settle down I might update at some point, but I don't see that happening for the moment.

A one-time activation I could bear instead of having a possibility that Sandboxie suddenly stops to work because of the activation. This is because I rely heavily on the "force" feature. But you don't want to hear that because everything has been said already, so again sorry and thank you for your help anyway.
Even if you didn't mean to, to me your last post had a distinct undertone indicating that I might not have a valid license which is not true. I just wanted to make that clear.

My experience with wuauserv errors is that they happen if internet/network access has been blocked in the sandbox.