On my server (Windows Server 2008 R2), I have installed a couple of programs coming with a web interface. As I want to be able to access those web interfaces from outside my LAN, the relevant ports are opened in the Windows Firewall and forwarded in my router.
Most of those programs realize their web frontend using an integrated Apache web server. In the default configuration, this web server is installed to run as a Windows Service under the user account "LOCAL-SYSTEM".
However, I am wondering, if I could improve security by changing the user account those service run. I have tried this with one of those applications with mixed success: It was really a hassle to figure out for which directories the user account needs read and/or write permissions.
Is that worth the effort?
Does running Apache under a more restricted user account actually increase security or is the default configuration "secure enough"?