5

I'm trying to have an NSIS Installer install a custom service as part of an installation. It would be nice to run the service with one of those typical 'NT Service\xyz' style virtual service accounts available in Win 7 and newer. As you might have guessed from the Win7, this is a deployment on a client machine, not a server.

It works just fine in my testing machine, but I have some doubts about the correct approach to permissions for this service user, especially when domain GPOs might be in effect.

In the simple case, the service gets its 'Log on as a service' permissions via the NT SERVICE\ALL SERVICES membership, but i have seen cases where this isn't the case and this group has the permissions explicitly revoked via GPO.

So the question is: Should an Installer for a client machine explicitly create/configure an ACL to grant 'Logon as a Service' to the newly created virtual service user, or should it hope/rely on the default 'NT Service\All Services' group to grant this permissions?

1 Answer 1

0

This is pretty old here, but since I'm here. It really doesn't matter if your applications modify the local security settings in this context. If GPO is controlling access to what can run as a service - it will overwrite your changes. This isn't a bad thing - it just means you need to document your requirements, and either get an exclusion to the GPO, or have a different GPO created that includes your requirements.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .