Missing cameras in the main view when running as a service

[Jiri]

Hello,

Enabled BI to auto start as a service and when I also try to start the interactive UI, the main view is just a black rectangle, the cameras are not visible. Note that if I right click into the black rectangle, the per camera context menu opens, so the mouse click events are still getting processed correctly, just nothing is visible. If I disable the service start, all is back to normal with cameras being visible. Though when I reenable service start, the same happens again.

The main reason this is bothering me is that if I want to just tweak a camera parameter, I would like to turn on the UI, tweak it, and then continue as a service. Is that possible or do I always need to disable service, restart UI, make a change, reenable service?

As is, this is what my UI looks like while the service is enabled (cropped the left and bottom tabs for privacy):



Thanks,
Jiri

 

[jmhmcse]

My first thought is that the BI user-id being used to login via UI3 has not been authorized to view/manage any cameras.

Having BI started as a service is not the issue. Once the BI user is authorized and granted 'administrator' BI access, some parameters can be changed from within UI3. Other parameters are changeable only from with the BI Main executable while others still are only changeable from within the camera's own menu.

 

[TonyR]

My first thought is that the BI user-id being used to login via UI3 has not been authorized to view/manage any cameras.

Having BI started as a service is not the issue. Once the BI user is authorized and granted 'administrator' BI access, some parameters can be changed from within UI3. Other parameters are changeable only from with the BI Main executable while others still are only changeable from within the camera's own menu.

I may have misunderstood but it's not UI3 that's black, that's BI's console view that's black in his screenshot.

 

[Jiri]

Thats right, the screenshot is from the BI native process, started as local_console. Note that in both cases, UI3 can see the streamed content of cameras. Its the BI that does not expose the visual of the cameras through its GUI.

 

[jmhmcse]

Which windows-user account/password is defined as BI's service account; the one which BI was originally installed? (if not, it should be)

When BI service is disabled you are logging into which windows-user account? When invoking BI, which shortcut are you clicking on to start BI?

When BI service is started, are you using the same windows account and same shortcut?

 

[Jiri]

Thanks for pushing me on this. I have installed as a user fooadmin, which part of the Administrators group. The local UI is being started (both when running as a service or not), using blueirisadmin.exe link, from under fooadmin user session. The service has been registered under a separate foo user, which is not part of the Administrators group. This should to be supported as per the BI help (Windows Administrator Access section):

It is possible to configure the software to allow access by non-
administrators in a couple of ways.

Since you need to install as admin, it should be therefore possible to run from a separate non-admin, including the service (as per help. further down in the same section):

First, when running as a service, you can un-check the default option on the Startup page in
Settings to Always run as Windows Admin. You must also:
• Configure a user/password on the Users page in Settings. The user will be prompted for
this when running the software. Although you may select Admin access for this account,
the user will only truly have Admin access if they are a Windows system administrator.

Now, trying to start blueirisadmin.exe GUI using runas from fooadmin usersession as foo, it fails to start, as foo is not part of Administrators group. Doing the same with blueiris.exe, it still results with the black GUI instead of the view of cameras. Did not try to use the various options to runas though.

Trying to follow your advice, switched the BI service to instead run with fooadmin creds, and afterwards, running blueirisadmin.exe from fooadmin session, while the service is running, the cameras are correctly displayed in the BI GUI.

@jmhmcse, you seem to be indicating the BI service needs to run as the same privileged account that originally was used to install BI, though the help seems to suggest otherwise. Is the help inaccurate here or just not up to date any more?

I would love to run BI as a low privilege process if possible (as in, not under a user that is part of Administrators group). Though to note, this is running on a dedicated PC and a segmented VLAN without Internet access.

 

[Flintstone61]

I on my 2 machines it all just works better if you Log in to Windows with the Administrator account then run BI as a service.

 

[jmhmcse]

Using the same admin account to install BI, run BI as a service, and log on as when running the local interface is to keep everything clean and simple.

While it may be possible to run the main interface with a non-admin/additional-user account, I've never tried. Nor have I tried using a non-admin account for the service.

The help-file section you refer to is authorizing a non-admin account to access BI once BI is operational. This does not state that a non-admin account is allowed to start the service.

The first line of that section reads:

Blue Iris is security software, and as such requires Windows Administrator access to the PC.​

I understand this as the service account requires Windows Administrator access and if a non-admin service account were used BI would not function properly.

Further down in that section there are instructions to modify the registry entry to allow EVERYONE access to the BI tree. If the non-admin foo cannot read the registry, then it would not know of any BI configuration; e.g. cameras to be displayed. Have you performed this additional step?

This still may not be enough as there are files within the BI's directory (fooadmin?) that also may need to be accessed. This too could be 'opened' to allow foo access, but we're getting far, far away from keeping things simple.

The desire to use non-admin accounts are valid; however, when it takes multiple custom configurations to implement you need to weigh the pros and cons.

--

Surprised with the use of foo but not bar as well.