1

My developer is telling me that in order to run a service with the reduced privileges of the built-in account SYSTEM\LocalService, he needs to grant it the "log on as a service" right.

How can this possibly be so? Half of the services in my Windows 2012 R2 machine are running as LocalService (the other half, inexplicably LocalSystem).

Developer points me to this page, where indeed, the right is not listed there. https://msdn.microsoft.com/en-us/library/windows/desktop/ms684188%28v=vs.85%29.aspx

Can someone explain this paradox to me?

Improve this question
2
  • You may find this post on StackOverflow helpful to clarify things.
    – BE77Y
    May 6, 2015 at 15:40
  • Yet another example of Microsoft's broken security policy. This right is supposed to be required to run a service as that account, but it seems the service control manager is broken and happily runs services under this account without the right.
    – psusi
    May 14, 2015 at 2:15

2 Answers 2

Reset to default
2

You don't need to grant this privilege as LocalService, as a built-in account, already has access to it. A lot of services run as LocalService (and there's a selection for it when you look at the service's properties). You only need to grant this permission if you're trying to run a service as a domain user which normally does not have that privilege.

Improve this answer
1

If you look at this link it also doesn't show localsystem as having the right to login as a service. https://msdn.microsoft.com/en-us/library/windows/desktop/ms684190(v=vs.85).aspx. The missing right is not necessarily missing. It's already "known" that it can login as a service. The permissions listed there are related to what it can do once logged in. Even in the gpo setting for "logon as service" mentions this: "Services can be configured to run under the Local System, Local Service, or Network Service accounts, which have a built in right to log on as a service. Any service that runs under a separate user account must be assigned the right."

Improve this answer
2
  • That's shocking if the only place this is explicitly documented is in the GPO help information.
    – Douglas Held
    May 14, 2015 at 15:14
  • The days of me being shocked by not finding info on MS site are long past. You can definitely find articles that talk about these services having logon as service rights on non-microsoft sites.
    – Jon
    May 15, 2015 at 16:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .