Minim as a service on Windows

[skeptic Mike]

I've been successfully running MinimServer as a service under 64 bit Windows 10 home. Do read all the relevant documentation before you do any of this.

Brief outline:
Get NSSM from http://nssm.cc (and read the documentation)
Copy (64 bit) NSSM.exe to C:\Program Files\NSSM
Copy Server JRE to C:\Program Files\Java (installing a JRE of your choice would also be ok)
Copy/Install MinimServer to C:\Program Files\MinimServer
Run NSSM.exe from an elevated command prompt:

>nssm install MinimService

In the Application tab:
path: C:\Program Files\Java\jdk1.8.0_91\jre\bin\java.exe
Startup Directory: C:\Program Files\MinimServer\lib
Arguments: -jar "C:\Program Files\MinimServer\lib\mserver.jar" --set watch.view=console --noprompt

Details tab:
Display Name: MinimServer Service

I/O tab:
Output: %userprofile%\MinimService.log
Error: %userprofile%\MinimService.log

leave everything else as the default.
Click on Install Service

Now, you need to configure the service to run with a virtual service account. From the command prompt:

>sc config MinimService obj= "NT SERVICE\MinimService"

and with a write restricted SID:

>sc sidtype MinimService restricted

You need to set the firewall so that MinimServer can be seen from other machines on your local subnet. Either do this yourself using the GUI (from control panel), or using 'netsh advfirewall firewall' from the command line. (Or cheat and do a trial run of MinmServer from a non-elevated command prompt, and wait for the prompt to open the firewall.)

You should install and run MinimWatch. Now you can start the service:

>sc start MinimService

This should turn your MInimWatch system tray icon red. Open and configure MinimServer as described in the documentation.

Note that as soon as you start MinimService, a new folder will appear in C:\Users (MinimService) This is the profile for the service, and where it's configuration lives. You can give permissions to this new virtual service account. As far as read permissions are concerned it has much the same rights as any other user account, so if you Music Library is in your personal "My Music" folder MinimService won't be able to read it, just as any other user wouldn't be able to read it. So, you would have to give MinimService permission to read it, either explicitly, or by giving users or everyone permission to read it. When you need the name of the account, it's "NT SERVICE\MinimService". If your music library is in a directory under the root of C:, or in the public profile (e.g. under Public Music) the MinimService should be able to read it.

The restricted write SID means that the only place the MinimService account can write is where it has explicit permissions. MinimServer only writes in the user profile, so that's fine, as the virtual service account will have full control in its own profile.

If Microsoft have helpful documentation about virtual service accounts and write restricted SIDs, I haven't been able to find it. The following may help:
http://searchenterprisedesktop.techtarge...erver-2008
http://www.christianlong.com/blog/twiste...e-accounts