I've written a web-application to run on Windows (XP,7,2008, etc), not using MS tools (python/django/nginx, though it should not matter). To run the app I've created a Windows Service which installs and runs fine.

However, the application will run in an environment where security is important. By default the service installs itself running under the Local System account, which I understand has full control of the computer. Doesn't sound like a good idea.

I've also seen Network Service used but descriptions tend to talk about domains and such. This app uses the network and is running on Windows, but doesn't talk "Windows" much if at all. It is self contained and keeps its data in the "common app data folder" aka ...\All Users\Application Data though.

Should I use Network Service? Should I create my own account? On unix I would, but not sure of the "gotchas" on Windows. Would be easier to use an existing account.

  • Ok, I did go for a specific unprivileged user after all, even though there was a lot of installer work to do. One of the gotchas was adding the "log on as a service" right and removing the "log on interactively" right. I used the command-line program for this called "ntrights" from the 2003 resource kit which can be downloaded at microsoft.com. – Gringo Suave Nov 12 '12 at 4:11
  • Another one, had to add "log on as a batch job" so I could run scheduled tasks with it. – Gringo Suave Nov 14 '12 at 23:36

Since you're coming from a Unix background you should be used to running under an unprivileged context. Many Windows developers don't have that kind of background and, as a result, we have a lot of service in the Windows ecosystem that require excessive privilege. I'm really glad to hear you questioning the need to run as "LocalSystem".

As a security-conscious Windows sysadmin I'd prefer that all my services run under unprivileged user accounts, either local to the server computer the service is running on or, if the service absolutely needs to access resources on other machines via Microsoft networking, a domain account.

I personally dislike any of the "Local Service", "Network Service", etc, contexts because they aren't user accounts that I can specifically control the parameters of. It is worth noting that "Local Service" always accesses remote machines with null sessions (anonymous credentials) and that behavior can't be duplicated with a normal user account. Still, I prefer an explicitly-specified unprivileged user to "Local Service", but "Local Service" is a perfectly reasonable choice, too. If you write your code to work as "Local Service" it should work fine as an unprivileged user, too, unless you write in some explicit dependencies on "Local Service".

  • Thanks for the info. If I use an unprivileged account, I suppose I'll need to use its app-data folder instead, correct? I've also created some convenience start menu items to the config file, not yet sure how to tackle those. – Gringo Suave Nov 10 '12 at 20:00
  • 1
    @GringoSuave - The common appdata folder is world-writable (which, personally, I think is a bug) so you can continue using it if you want. Making shortcuts to a per-user appdata folder in the Start Menu to allow other users to edit the configuration is going to be painful, certainly. I'd probably opt to put the configuration in the a subfolder of the common appdata folder and protect it with an ACL. – Evan Anderson Nov 10 '12 at 20:15
  • 1
    Good idea, I can allow access by the user and admins only via ACL. – Gringo Suave Nov 10 '12 at 20:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.