Symptoms

The adTempus service fails to start and Windows gives the following error message:

Windows could not start the adTempus 4 Server service on Local Computer.
Error 1068: The dependency service or group failed to start.

adTempus has a dependency on the SQL Server service for the adTempus instance. When you try to start the "SQL Server (ADTEMPUS)" service, it also fails to start and Windows gives the following error message:

Windows could not start the SQL Server (ADTEMPUS) service on Local Computer.
Error 1069: The service did not start due to a logon failure.

In addition, the System log in the Event Viewer shows error 7041:

The MSSQL$ADTEMPUS service was unable to log on as NT Service\MSSQL$ADTEMPUS with the currently configured password due to the following error:
Logon failure: the user has not been granted the requested logon type at this computer.

Cause

This problem occurs if the "Log on as a service" right has been removed from the account that the SQL Server service runs under.

Resolution

On Windows Server 2008R2, Windows 7, and newer platforms, the SQL Server 2012 Express instance installed by adTempus is configured to run under a service account named "NT Service\MSSQL$ADTEMPUS," and this account is given the "Log on as a service" right. If this right is removed, the service will not be able to start.

To restore this right:

  1. Open the Local Security Policy editor on the computer.
  2. Go to Security Settings/Local Policies/User Rights Assignment.
  3. Locate the "Log on as a service" policy and double-click to open it.
  4. If the "NT Service\MSSQL$ADTEMPUS" account is not listed, add it.
  5. Click OK to save the settings.

You should now be able to start the SQL Server (ADTEMPUS) and adTempus services.

However, it is likely that this right was removed because the local policy was overwritten by a Group Policy. This means that the next time the computer gets a policy update, the right will once again be removed, and the services will fail to start the next time they are restarted. To work around this problem, you must use one of these approaches:

  • Option 1: In the Group Policy Object that affects the computer, grant the "Log on as a service" right to "NT SERVICE\ALL SERVICES". Note that you must assign the right to ALL SERVICES, because the "MSSQL$ADTEMPUS" is not defined at the domain level and therefore cannot be granted rights in the Group Policy.
  • Option 2: Exclude the affected computer from the Group Policy that is overwriting the setting.