StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

PO
text
Body
copied!<p>Since there is so much confusion about functionality of standard service accounts, I'll try to give a quick run down.</p> <p>First the actual accounts:</p> <ul> <li><p><a href="http://msdn.microsoft.com/en-us/library/windows/desktop/ms684188%28v=vs.85%29.aspx" rel="noreferrer"><strong>LocalService</strong> account</a> (preferred) </p> <p>A limited service account that is very similar to Network Service and meant to run standard least-privileged services. However, unlike Network Service it <strike>has no ability to access the network as the machine</strike> accesses the network as an <em>Anonymous</em> user.</p> <ul> <li>Name: <code>NT AUTHORITY\LocalService</code></li> <li>the account has no password (any password information you provide is ignored)</li> <li>HKCU represents the <strong>LocalService</strong> user account</li> <li>has <em>minimal</em> privileges on the local computer</li> <li>presents <em>anonymous</em> credentials on the network</li> <li><strong>SID</strong>: S-1-5-19</li> <li>has its own profile under the <strong>HKEY_USERS</strong> registry key (<code>HKEY_USERS\S-1-5-19</code>)</li> </ul> <p> </p></li> <li><p><a href="http://msdn.microsoft.com/en-us/library/windows/desktop/ms684272%28v=vs.85%29.aspx" rel="noreferrer"><strong>NetworkService</strong> account</a> </p> <p>Limited service account that is meant to run standard privileged services. This account is far more limited than Local System (or even Administrator) but still has the right to access the network as the machine (see caveat above).</p> <ul> <li><code>NT AUTHORITY\NetworkService</code></li> <li>the account has no password (any password information you provide is ignored)</li> <li>HKCU represents the <strong>NetworkService</strong> user account</li> <li>has <em>minimal</em> privileges on the local computer</li> <li>presents the computer's credentials (e.g. <code>MANGO$</code>) to remote servers</li> <li><strong>SID</strong>: S-1-5-20</li> <li>has its own profile under the <strong>HKEY_USERS</strong> registry key (<code>HKEY_USERS\S-1-5-20</code>)</li> <li>If trying to schedule a task using it, enter <code>NETWORK SERVICE</code> into the <em>Select User or Group</em> dialog </li> </ul> <p> </p></li> <li><p><a href="http://msdn.microsoft.com/en-us/library/windows/desktop/ms684190%28v=vs.85%29.aspx" rel="noreferrer"><strong>LocalSystem</strong> account</a> <em>(dangerous, don't use!)</em> </p> <p>Completely trusted account, more so than the administrator account. There is nothing on a single box that this account cannot do, and it has the right to access the network as the machine (this requires Active Directory and granting the machine account permissions to something)</p> <ul> <li>Name: <code>.\LocalSystem</code> (can also use <code>LocalSystem</code> or <code>ComputerName\LocalSystem</code>)</li> <li>the account has no password (any password information you provide is ignored)</li> <li><strong>SID</strong>: S-1-5-18</li> <li>does not have any profile of its own (<code>HKCU</code> represents the <strong>default</strong> user)</li> <li>has <em>extensive</em> privileges on the local computer</li> <li>presents the computer's credentials (e.g. <code>MANGO$</code>) to remote servers </li> </ul> <p> </p></li> </ul> <p>Above when talking about accessing the network, this refers solely to <a href="http://en.wikipedia.org/wiki/SPNEGO" rel="noreferrer">SPNEGO</a> (Negotiate), NTLM and Kerberos and not to any other authentication mechanism. For example, processing running as <code>LocalService</code> can still access the internet. </p> <p>The general issue with running as a standard out of the box account is that if you modify any of the default permissions you're expanding the set of things everything running as that account can do. So if you grant DBO to a database, not only can your service running as Local Service or Network Service access that database but everything else running as those accounts can too. If every developer does this the computer will have a service account that has permissions to do practically anything (more specifically the superset of all of the different additional privileges granted to that account).</p> <p>It is always preferable from a security perspective to run as your own service account that has precisely the permissions you need to do what your service does and nothing else. However, the cost of this approach is setting up your service account, and managing the password. It's a balancing act that each application needs to manage.</p> <p>In your specific case, the issue that you are probably seeing is that the the DCOM or COM+ activation is limited to a given set of accounts. In Windows XP SP2, Windows Server 2003, and above the Activation permission was restricted significantly. You should use the Component Services MMC snapin to examine your specific COM object and see the activation permissions. If you're not accessing anything on the network as the machine account you should seriously consider using <strong>Local Service</strong> (not Local System which is basically the operating system). </p> <hr> <p>In Windows Server 2003 <a href="https://serverfault.com/a/513829/4822">you <strong>cannot</strong> run a scheduled task</a> as </p> <ul> <li><code>NT_AUTHORITY\LocalService</code> (aka the Local Service account), or </li> <li><code>NT AUTHORITY\NetworkService</code> (aka the Network Service account). </li> </ul> <p>That capability only was added with Task <a href="http://msdn.microsoft.com/en-us/library/windows/desktop/aa383614%28v=vs.85%29.aspx" rel="noreferrer">Scheduler 2.0</a>, which only exists in Windows Vista/Windows Server 2008 and newer.</p> <p>A service running as <code>NetworkService</code> presents the machine credentials on the network. This means that if your computer was called <code>mango</code>, <a href="https://serverfault.com/a/135874/4822">it would present as the machine account</a> <code>MANGO$</code>:</p> <p><img src="https://i.stack.imgur.com/exvfr.png" alt="enter image description here"></p>

Querying!

Guidance

An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload