Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

What are the pros and cons, or best practices when it comes to setting up applications on a server with either the Network Service account or a domain account?

Are there some cases in which you'd do one, and other cases where you'd do the other?

share|improve this question

closed as too broad by HopelessN00b, mdpc, MichelZ, Wesley, Jacob Jul 14 at 16:20

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

2  
This might help: serverfault.com/questions/571761/… –  serverimeco Jul 10 at 15:57

2 Answers 2

up vote 5 down vote accepted

Using a domain account requires administration and protection of the account and password. Using the builtin NetworkService or LocalService identities has lower administrative effort and does not require protection of the service account password.

The builtin identities have predefined permissions for some objects on the system and may be shared by multiple applications on the system. Using a domain account provides the ability to specify permissions only to the objects that are needed, and can be limited exclusively to a single application.

If you have Windows 2008 R2 or later, Managed Service Accounts may be another option. MSA's combine the convenience of a builtin identity, but finer granularity of control over what the identity has access to and what applications can use the identity.

Introducing Managed Service Accounts
http://technet.microsoft.com/en-us/library/dd560633%28v=ws.10%29.aspx

Managed Service Accounts Frequently Asked Questions (FAQ)
http://technet.microsoft.com/en-us/library/ff641729%28v=ws.10%29.aspx

share|improve this answer

The difference really boils down to how the service will interact with other machines over the network (using Microsoft networking protocols). The "Network Service" is, effectively, an unprivileged user that authenticates as the computer's domain account when accessing remote resources. Assuming that your domain account is just a member of the "Users" group on the machine where the service is running its permission to the local machine will be the same as "Network Service", but the service will authenticate with the domain account's credential when accessing remote services.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.