9

We're running several services in our company using a shared domain account. Unfortunately, the credentials for this account are widely distributed and being used frequently for both service and non-service purposes. This has led to a situation where it is possible that the services will be temporarily down due to this shared account being locked.

Obviously, this situation needs to change. The plan is to change the services to run under a new account, but I don't think this goes far enough, as that account is subject to the same locking policy.

My questions is this: Should we be setting up the service accounts differently than other domain accounts, and if we do, how do we manage those accounts. Please keep in mind that we are running a 2003 domain, and upgrading the domain controller is not a viable solution in the near term.

Improve this question

1 Answer 1

Reset to default
7

A few thoughts:

  • One account per service, or perhaps per service type depending on your environment.

  • Accounts should be domain accounts.

  • Accounts should have a strong password that doesn't expire*. Ideally generate a random password that gets recorded somewhere (KeePass is good for this) to make it a pain for people to use it for logging on. Speaking of which...

  • ...(In general) the account should be a member of a group that does not have the rights to log on interactively. This can be controlled via Group Policy.

  • Keep in mind the principle of least privilege. Accounts should have the rights they need to do their job and no more. Inkeeping with this, as gravyface points out, use the built in accounts where possible. Local Service when network access is not required. Network Service when accessing the network as the machine account will be secure enough, and avoid using the Local System account where possible.

*Unless your company security policy isn't compatible with this, but by the sounds of things it probably is :-)

Improve this answer
3
  • If a hacker gets SYSTEM, he/she can easily inject their payload into any process or service running as a domain account and with that, have whatever access that particular domain user has. I typically use LocalService when I don't need network access (locally running SQL instance for example).
    – gravyface
    Sep 28, 2012 at 22:20
  • 1
    @gravyface This is a good point. I tend to think of specific service accounts as 'services that can't use the built in accounts' so it's worth making that distinction
    – Chris McKeown
    Sep 28, 2012 at 22:23
  • Is it possible to disable locking at the group policy level, in 2003? Is this a good idea?
    – LockeCJ
    Oct 1, 2012 at 17:08

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .