Tag Info

Hot answers tagged

10

It gives your application a particular account by which you can set security. Normally the process would run as the IIS user account, and therefor have all the privildges associated with that account. By creating an account just for that application, you can assign rights to that service account for only the resources it needs. It significantly reduces the ...


10

Disabling an account wont log a disabled user out, it will just stop them logging in. Oh, you didnt notice the last login was May 2011..? (A year ago)


10

There isn't really a specific best practice, except that the shell should be /bin/false unless a shell is needed, the password hash should be ! unless the user is expected to log in, a descriptive name should be given, and a home directory should be set to /dev/null or similar if the application doesn't require a valid home directory. The user should have ...


6

A service account is used for two things: Isolation and auditing. Isolation allows you to grant the minimal rights necessary for the service to the service account, ensuring that even if an attacker were to exploit the service and gain local system access his ability to do further damage is limited. Even in a case where an attacker is not a concern ...


6

You can create settings in your local group policy (gpedit.msc) to achieve this. Look under Computer Config | Windows Settings | Security Settings | Local Policies | User Rights Assignment. The specific ones you want are Deny logon as a batch job, Deny logon locally and Deny logon through Terminal Services. You can also tune some of the other settings ...


6

Everything the user does requires access to large portions of the filesystem. To prove this to yourself, run the following command: strace -e trace=file /bin/ls/$HOME You'll see that listing the contents of your own home directory requires opening and reading at least 40 other files scattered around your system. Other commands, like sftp and such ...


5

You can use devxexec: http://blog.developex.com/?p=1053 For example: devxexec.exe /user:NETWORK_SERVICE cmd


5

Backup software should run as "a user with the lowest privilege level required in order for it to read & back up all of the files you want backed up". Typically this means root (or some other UID 0 account) on Unix systems, and a member of the Backup Operators group on recent versions of Windows. Some Windows backup software that doesn't take advantage ...


5

Permission to modify the properties of Active Directory (AD) objects is controlled by Access Control Lists (ACLs). ACLs are applied to objects explicitly (without inheritance) or implicitly by inheritance from the container (OU or Container object) the object is located within. Delegating control of attributes to a user or group (you should almost always ...


5

Using a domain account requires administration and protection of the account and password. Using the builtin NetworkService or LocalService identities has lower administrative effort and does not require protection of the service account password. The builtin identities have predefined permissions for some objects on the system and may be shared by ...


4

The difference really boils down to how the service will interact with other machines over the network (using Microsoft networking protocols). The "Network Service" is, effectively, an unprivileged user that authenticates as the computer's domain account when accessing remote resources. Assuming that your domain account is just a member of the "Users" group ...


4

It depends! If they're being used by something native to Windows (say, services or task scheduler or IIS app pools), then they're fine to move. However, if they're being used as LDAP bind accounts (often in third-party software), there's a pretty good chance that something's hardcoded to the account's current distinguished name (which will change on move). ...


4

Just create a user account that is member of the Domain users group. That account won´t have any write permissions on the other objects of the directory except for itself. If you need some more advance service accounts, Windows 2008 R2 has something called Managed Service Accounts. I have never used them but it won´t hurt to have a look at them: ...


4

Basically: If the application breaks, then the damage it can do is restricted only to files owned or writable by that user. Also, if the application is compromised, then the same restriction applies to the data that can be accessed through it. In principal, every item of software should only be able to access to resources it needs and nothing else. ...


3

We follow the first group, which has a seperate service account for each environment & server application. The main reason is security, but another good reason is that if some work is being done in test or dev, which requires changing security, you know that it is not impacting the production environment in any way.


3

I generally create a single domain service account and use that for all of the services on all of the servers. My suggestion would be to do one of two things: Create a single domain service account that is used for all services on all servers. Create a domain service account for all of the services on each server, so you'll have a separate service account ...


3

2008R2 domains would have Active Directory Web Services by default. In a 2003/2008 domain, you will need to install Active Directory Management Gateway Service before you can use the ActiveDirectory Powershell modules. You cannot, in any supporting documentation I have read, use Managed Service Accounts without an AD domain.


3

Account names ending in a $ are normally machine accounts, not user (even non-iterative user) accounts. It is quite possible that TFS, or something that TFS uses, assumes this and thus blocks the name. (Otherwise, be very sure you have correctly typed the password. I've ended up using copy and paste for both account creation and its use to allow a long and ...


3

Check the year. It has not logged on since it was disabled.


3

Your app is just looking for a user account to run as. You'll probably find that you need to assign some special permissions to the account later in the directions. If you're domain is operating a 2008 R2 level, then you'll probably want a Managed Service Account. It's more complicated, but it changes it's own password and is generally more secure. If ...


3

The security policy in the Default Domain Controllers Group Policy Object (GPO) doesn't permit unprivileged users to logon interactively or as batch jobs (which is how Scheduled Tasks run) on Domain Controller (DC) computers. Your first problem in making this account unprivileged (which is a good idea) is going to be modifying the security policy. Your ...


3

Most of the places I've worked have used a domain account that is otherwise unprivileged, although I've also worked places that used a local account that is otherwise unprivileged. My understanding is that this is pretty standard practice. If you google, you can find a lot of articles explaining why not to use local system, but they generally boil down to ...


3

I have found out what the issue was, my mistake was thinking that BITS used the same proxy settings defined in IE but it has its own settings for the service accounts that can only be changed using the BITSAdmin tool. When I initially ran this it showed some invalid proxy settings C:\Windows\System32>bitsadmin /util /getieproxy localsystem so I then ...


3

First, when you say 40 admin level accounts I'm going to assume you mean Domain Admin. 40 of these type of accounts is dangerous for so many reasons that I'm sure you can already guess. What I would recommend as the first thing to do would be to open the Domain Admin, Enterprise Admin, and Schema Admin groups in Active Directory. Opening these groups up ...


3

It depends on the service. If the service does not access network resources such as a network file share on a regular basis, but instead only does stuff on the local machine, then no it will not matter if you change the service account's password in Active Directory. The service will keep chugging along indefinitely until the service is eventually restarted ...


2

You cannot use gMSA for SQL services, it's unsupported. You must instead use MSA. Source: http://blogs.msdn.com/b/sqlosteam/archive/2014/02/19/msa-accounts-used-with-sql.aspx


2

Most third party identity and access management software can handle this type of access control by completing the request on behalf of the user, usually using a domain admin credential (but it could always be locked down further). Unfortunately, Windows itself can't do this: group membership in AD is really just being listed in the group's list of members ...


2

The answer has been blogged here: http://blogs.technet.com/b/askpfeplat/archive/2012/12/17/windows-server-2012-group-managed-service-accounts.aspx The short version is to use the Register-ScheduledTask PowerShell cmdlet combined with New-ScheduledTaskPrincipal -LogonType Password -UserID YourDomain\YourgMSA$.


2

The account was modified after it was disabled. This can happen for a variety of reason. Disabled accounts can still be changed. And of course, you will not be able to pull down data with a disabled account.


2

Create a user account, grant it the ability to 'run as a service' and 'act as part of the OS' from the local security policy. Ensure that that account has permissions to your Apache directories. Once your service is installed, configure it to run as that user.



Only top voted, non community-wiki answers of a minimum length are eligible