Knowledge Base › Troubleshooting › Signing Fails in Service Mode

Signing Fails in Service Mode

Apr 5, 2026 · 436 views

Symptom: signing works when you click buttons in the GUI, but fails when triggered through the service (folder watch, API): "Cannot access USB token", "PIN dialog cannot be displayed", or signatures simply never happen.

Why This Happens: Session 0 Isolation

Windows services run in Session 0 — an isolated session with no desktop. USB-token CSP/KSP drivers assume a desktop: they need it for PIN dialogs and, in many cases, for any private-key operation at all. So a service alone cannot sign with a hardware token. This is a Windows platform constraint, not an OneSigner limitation — every signing product faces it.

How OneSigner Solves It

The service detects an active user desktop session and runs the actual token operation inside that session (via CreateProcessAsUser), returning the result to the service. For this to work, three conditions must hold:

1. An Interactive User Session Must Exist

  • A user is logged in at the console — the lock screen is fine, logged-out is not.
  • After a reboot with nobody logged in, there is no session — signing fails until login.

2. Auto-Logon for Unattended Servers

  1. OneSigner Configuration → General tab → Auto-Logon section.
  2. Enter the Windows username, password and domain; click Apply Auto-Logon. The status shows "Auto-Logon is ON".
  3. After every restart (updates, power loss), Windows logs that user in automatically and signing resumes. Physically secure the machine and lock down RDP, since the console session is live.

3. Service Runs as LocalSystem

The service account must remain LocalSystem (the installer default). Only LocalSystem may call WTSQueryUserToken, which OneSigner needs to enter the user session. Don't switch the service to a normal account.

4. Store the PIN

Save the token PIN in each signing profile (encrypted with DPAPI). Without it, the driver pops a PIN dialog that nobody is there to answer.

Quick Diagnostic Checklist

  1. query session in a terminal — is there an Active console session?
  2. Service running as LocalSystem? (services.msc → OneSignerService → Log On tab)
  3. PIN saved in the profile? (Test Sign in the GUI succeeds without prompting?)
  4. GET /api/signing/status — what does lastError say?