I am building Group Policy for a new domain that we are migrating to. In our current environment the settings Log on as a Service is set at the Server OU level - which has about a hundred Service Accounts in that field for having access to this right.
I would like to set this lower down our OU tree structure (we separate out servers based on the application that they run), but a couple of our internal staff have want to not set this policy at all. IE: not checking the setting in Group Policy and let the local servers deal with what accounts are put into its local policy for this setting. Our internal security team want it set as I do, but the couple of people who don't want it set includes an Architect - hence the conflict.
I have consulted with Microsoft Premier Support (who didn't have an official answer for me), internal staff, external IT friend staff, and hours of internet research - but I cannot find any information on if this policy should be set at all. My instincts are to manage this via GPO so that it can be easily audited and managed from one place (our company goes through various external audits from time to time).
The Microsoft resource page: https://technet.microsoft.com/en-us/library/dn221981.aspx is about the only information I can find about it, but it says to minimize the number of accounts that are granted this user right. This seems a bit ambiguous to me...
Can someone please tell me what they think about this settings?