The Windows service

The installer registers phaf as a Windows service. The service starts with the server, runs whether or not anyone is signed in, and starts phaf again if it ever stops. This page shows how to manage it and how to run it under a dedicated account.

1. Start, stop and check

Use Services (services.msc) or PowerShell:

$svc = Get-Service | Where-Object DisplayName -like 'phaf*'
$svc                      # Status and start type
Stop-Service  $svc.Name
Start-Service $svc.Name

# Is phaf answering?
Invoke-WebRequest http://127.0.0.1:8181/ -UseBasicParsing | Select-Object StatusCode   # 200

Restart the server once to confirm phaf comes back on its own.

2. Run the service under a dedicated account

A dedicated account limits what phaf can reach on the server. Use a domain account when flows read or write Windows network shares, because a local account cannot open them.

1. Create the account, for example a local account:

$password = Read-Host 'Password for phaf-svc' -AsSecureString
New-LocalUser -Name 'phaf-svc' -Password $password -PasswordNeverExpires -AccountNeverExpires -Description 'Runs phaf DATA CONNECTOR'

2. Do not add it to the Administrators group. Store its password in your password manager.
3. Give it the folder permissions in the next step.
4. In Services, open the phaf service › Log On › This account, enter the account and its password, and restart the service.

3. Folder permissions

The service account reads the application and writes the data. The data folder holds the encryption key, so only the service account, SYSTEM and administrators may open it.

# Application: read only
icacls C:\phaf\app /grant 'phaf-svc:(OI)(CI)RX'

# Data: no inherited access, only SYSTEM, Administrators and phaf-svc
icacls C:\phaf\data /inheritance:r /grant:r 'SYSTEM:(OI)(CI)F' 'Administrators:(OI)(CI)F' 'phaf-svc:(OI)(CI)M'

If you use a domain account, write it as YOURDOMAIN\svc-phaf. If flows read or write other local folders, give the account access to them too. Even if you keep the default system account, restrict the data folder to SYSTEM and Administrators.

If the service does not start

• Logon failure — the account password is wrong or has changed, or the account lacks the "Log on as a service" right. Enter the password again in the Log On tab; Windows grants the right when you save it there.
• The service runs but phaf does not answer — open Event Viewer › Windows Logs › Application and System for service errors. A permission error on C:\phaf\data means step 3 was skipped.
• Port in use — another program took the port after installation. Free it, or change port in config.json, update the proxy and restart the service.