Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How do you grant access to network resources to the LocalSystem (NT AUTHORITY\SYSTEM) account?


Background

When accessing the network, the LocalSystem account acts as the computer on the network:

LocalSystem Account

The LocalSystem account is a predefined local account used by the service control manager.

...and acts as the computer on the network.

Or to say the same thing again: The LocalSystem account acts as the computer on the network:

When a service runs under the LocalSystem account on a computer that is a domain member, the service has whatever network access is granted to the computer account, or to any groups of which the computer account is a member.

How does one grant a "computer" access to a shared folder and files?


Note:

Computer accounts typically have few privileges and do not belong to groups.

So how would i grant a computer access to one of my shares; considering that "Everyone" already has access?

Note: workgroup

share|improve this question
add comment

2 Answers

up vote 25 down vote accepted

In a domain environment, you can grant access rights to computer accounts; this applies to processes running on those computers as LocalSystem or NetworkService (but not LocalService, which can't access the network at all presents anonymous credentials on the network) when they connect to remote systems.

So, if you have a computer called MANGO, you'll have an Active Directory computer account called MANGO$, which you can grant permissions to.

enter image description here

Note: You can't do any of this in a workgroup environment; this applies only to domains.

share|improve this answer
5  
+1 and accepted. But: LocalService can access the network, it just "presents anonymous credentials on the network" (msdn.microsoft.com/en-us/library/ms684188(VS.85).aspx) –  Ian Boyd Apr 27 '10 at 2:12
    
Didn't know that, thanks. –  Massimo Apr 27 '10 at 5:38
    
Just to mention, having spent a not inconsiderable amount of time trying to get this to work for multiple domains I don't think it's possible. i.e. \\DOMAIN2\MANGO$ doesn't appear to grant access. –  BennyB Jul 9 '13 at 13:31
    
This only works if the domains are in a trust relationship; otherwise, you're correct, it doesn't work. –  Massimo Jul 9 '13 at 15:06
add comment

You don't. If you need a service to connect to remote files or other network services, then you want to have the service run as a named account, and on the remote machine, assign rights to that named account.

It would really be best if you full explain what you're trying to do - that way you'll get the best answers.

share|improve this answer
2  
Totally incorrect. You can grant permissions to machine accounts (and thus to services running as them) exactly the same way you can grant them to user accounts. There are of course scenarios where this might not be the best solution, but it's perfectly doable. –  Massimo Apr 26 '10 at 15:21
    
@Massimo: mfinni is not saying that you can't technically do it, but that you dont want to do it--It is best practice to run the service as a named account. –  Josh Brower Apr 26 '10 at 16:54
    
The answer looked exactly like that, this is the reason for my downvote; also, the original poster seem to know quite well the difference between an user account and a computer one, so answering his question with "don't do that" just didn't seem right to me. –  Massimo Apr 26 '10 at 17:01
    
Also, downvoting my answer (which is technically correct, as opposed to mfinni's one) is not exactly fair. –  Massimo Apr 26 '10 at 17:04
2  
Ian - if that's what you're after, it's usually a better idea to use the SQL Server Agent and its account, or use Integration Services. You can get more detail when you ask a detailed question, and it can still be very applicable to other readers' situations. –  mfinni Apr 27 '10 at 3:16
show 5 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.