Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am deploying an application which scans files. Our systems access management team will provide a Windows non interactive service account so the app can access file shares. They've just told me that there is no way to prevent a user from using the service account to map a drive and so view the files.

I'm not a network guy so dont know if this true. Is there any way to prevent drive mapping?

share|improve this question
add comment

1 Answer 1

You're being painfully vague, but they're saying that they'll create a service account for your service to log in as and run under.

However, there is no actual concept of "service accounts" in Active Directory or locally*, so in every way this is just a standard user with whatever rights are required etc. They may choose to restrict it as much as is reasonably possible (NB: Or, they may not!) but ultimately it's going to need access to some things for your software to work.

If somebody got hold of the username and password then yes, they could in theory use it to authenticate and access whatever your software accesses.

However, this isn't a security risk in itself - no more than having administrative accounts etc. The answer is the same: Make the password complicated, random and release it to only those who genuinely need it.

We'd need far more detail on your environment before we could recommend other specific ways to mitigate risk, but I'm not sure it would do your professional relationship any good to approach them with said answers.

*The idea is, however, best practice, well documented and understood. But you must understand there is no "Service Account" user type or anything. It's just a descriptive term.

share|improve this answer
4  
    
@ChrisMcKeown Wow, I hold my hand up and say I'd never heard of those nor have I ever seen them in use. I'll leave my answer for the moment as they're relevant to 2008R2 & 7 –  Dan May 1 '12 at 12:00
    
I agree, I doubt that the OP was referring to the new Service Account type since they look like a pain to actually use, but thought it worth mentioning since they do exist. –  Chris McKeown May 1 '12 at 12:07
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.