1

My developer is telling me that in order to run a service with the reduced privileges of the built-in account SYSTEM\LocalService, he needs to grant it the "log on as a service" right.

How can this possibly be so? Half of the services in my Windows 2012 R2 machine are running as LocalService (the other half, inexplicably LocalSystem).

Developer points me to this page, where indeed, the right is not listed there. https://msdn.microsoft.com/en-us/library/windows/desktop/ms684188%28v=vs.85%29.aspx

Can someone explain this paradox to me?

  • You may find this post on StackOverflow helpful to clarify things. – BE77Y May 6 '15 at 15:40
  • Yet another example of Microsoft's broken security policy. This right is supposed to be required to run a service as that account, but it seems the service control manager is broken and happily runs services under this account without the right. – psusi May 14 '15 at 2:15
2

You don't need to grant this privilege as LocalService, as a built-in account, already has access to it. A lot of services run as LocalService (and there's a selection for it when you look at the service's properties). You only need to grant this permission if you're trying to run a service as a domain user which normally does not have that privilege.

| improve this answer | |
1

If you look at this link it also doesn't show localsystem as having the right to login as a service. https://msdn.microsoft.com/en-us/library/windows/desktop/ms684190(v=vs.85).aspx. The missing right is not necessarily missing. It's already "known" that it can login as a service. The permissions listed there are related to what it can do once logged in. Even in the gpo setting for "logon as service" mentions this: "Services can be configured to run under the Local System, Local Service, or Network Service accounts, which have a built in right to log on as a service. Any service that runs under a separate user account must be assigned the right."

| improve this answer | |
  • That's shocking if the only place this is explicitly documented is in the GPO help information. – Douglas Held May 14 '15 at 15:14
  • The days of me being shocked by not finding info on MS site are long past. You can definitely find articles that talk about these services having logon as service rights on non-microsoft sites. – Jon May 15 '15 at 16:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.