Current Scenario: I have a NAS Box, and a Windows 2003 Server that our recording software is on (Security Cameras). The software stores the data on the NAS box. Currently someone has to be logged in with valid credentials in order to keep the drive mounted (e.g. domain admin). I know you can mount the drive with a batch file, but this stores credentials in clear text and is not a good solution. I am looking for another way to get the drive to mount on startup without someone having to be logged in. I do have a generic account setup that has access to read/write to the drive but can't log-in interactively, this is the account I would like to use to mount it if any. Any suggestions?
What is the reason that you need to map a drive? Is it just so that you can store the user credentials? If the security PC can save to a UNC path (\\servername\share), then you could try running the service as a different user, one that has permission to access the share.
Let me know if I am on the right track here:
\\nasbox\SecurityFootage is where the files must be saved to, but they do not permit anonymous read/write access. So, at the moment, you map a network drive, (let's say M:), using credentials, and tell the security cameras to record there.
Because the security software runs as a service, you would prefer it if could just start automatically with the system, and write to the M: - but at the moment it can't because there's no anonymous access to \\nasbox\SecurityFootage
IF the scenario I've just described is accurate, then there is workaround:
- Leave the NAS box alone, with all its security intact
- Change the account that the service runs under to the non-interactive user you mentioned in your question
- To do this, Right-click on the service, go to Properties, Log On, and choose "This Account", and enter the domain credentials in there
This will mean that when the recording service starts it will be run under the account specified, and will thus have permissions to save to \\nasbox\SecurityFootage
If the NAS box supports iSCSI, you could mount the remote storage as a local drive.
Have you tried telling the software to store on a UNC path instead of a drive letter?
Use the batch file and a scheduled task. Protect the batch file with NTFS permissions and the scheduled task using permissions as well.