Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I remember there was a tech-net or WindowsITpro article about how to harden windows 2003 service accounts a couple of years ago.

For backup software purposes (such as BackupExec / AppAsure / Etc.. , please don't bash these) I have to create a domain admin account (usually called something such as "backup") and have the services run from that account.

In this article I remember you can create the domain admin user "Backup" however have it not able to login interactively.

Do any of you remember such an article or have the knowledge on how to do it?

share|improve this question
1  
Denying interactive logon permission is security theater. If I "own" a "Domain Admins" member account that doesn't have interactive logon privileges I'll just remotely edit your security policy to remove the restriction or use the credential to create another "Domain Admins" member account that does. –  Evan Anderson Apr 30 '11 at 18:16

3 Answers 3

I advise to create a group called something like 'DenyLogonLocally'. Then make sure this group is denied from logging on locally by using a GPO.

Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Local Policies -> User Rights -> Deny Logon Loccaly

Add the Backup user and other service accounts to this group. You might want to consider the same technique with the user rights 'Deny log on through Remote Desktop Services' and 'Deny Access to this computer from the network'.

John's tips are good aswell.

share|improve this answer

There is a user rights setting that restricts interactive login. Look for Local security policy and User rights assignment. Test before you go too far.

You might also use an insanely long password/passphrase since you won't need to enter it very often. This is a great way to harden the account.

share|improve this answer

I do remember seeing such articles but all they really said, in far too many words, was:

  • Limit the access the account has. In particular, don't make them Domain Admin if there is any way to avoid it.
  • Make the account credentials as secure as practical. i.e. Try not to use obvious names for the account and ensure the passwords are long and strong.
  • Don't allow anyone to access the account unless they really need to, so set the permissions on the account itself accordingly.
  • Ensure the relevant details are securely logged and protected. After all, if you can remember them you either have an exceptional memory or you have failed in choosing a secure enough password.
  • As with any other important account, ensure the password is changed periodically.

It's unfortunate that some backup systems, such as BackupExec, require the account to be Domain Admin, even though Backup is all it really needs. That's just poor design but of course we users don't have any control over it.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.