I'm trying to run the DHCP Server service under a low-permissions account (partly to reduce attack-vectors, and partly just for kicks), as it runs under LOCAL SYSTEM by default.
I've successfully gotten the DNS Server service running with a low access account (.\dns), but the DHCP one just isn't working.
I've been using ProcessMonitor to track any ACCESS DENIED events on the system and/or tcpsvcs.exe, but there are none when I'm starting the service; yet the SCM reports back that 'Access is denied'.
There is nothing in the Event Log (Application,Security,System) regarding the cause of failure, and I've already granted the .\dhcp user account the following permissions:
C:\WINDOWS\system32\dhcp[Full Control + Subfolders]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DHCPServer[Full Control + Child Keys]
The final operation when the SCM reports back the error is an attempted WriteFile to
\\MACHINENAME*\MAILSLOT\NET\NETLOGON - but running this under the default system account results in the identical error (bad network path), so am not sure if this is entirely related.
Does anyone have any tips or suggestions?
OS: Windows Server 2003 R2 Enterprise x86 SP2
With the .\dhcp user in the
Administrators group, the service starts. When in the
Network Configuration Operators,
DHCP Administrators, and
Power Users groups the service fails to start.
To check if the adapter is running in promiscuous mode, I tested with nmap when the service is running:
nmap -sU -vv --script=sniffer-detect 192.168.134.202 ... PORT STATE SERVICE 53/udp open domain 67/udp open|filtered dhcps 68/udp open|filtered dhcpc 123/udp open ntp ... MAC Address: 90:B1:1C:87:8A:3B (Unknown) Host script results: |_sniffer-detect: Unknown (tests: "11____1_")
netstat -anb on the server returned:
... UDP 192.168.134.202:68 *:* 3432 [tcpsvcs.exe] UDP 192.168.134.202:67 *:* 3432 [tcpsvcs.exe]
No sign of it listening on 0.0.0.0