We have a patching service which is a windows service that patches the non domain controller and domain controllers. Currently we were using same service account(account_abc
) which has a Domain Administrator privilege
to patch all the servers
We are planning to remove this privilege due to security reasons. So now we have to come up with a solution for a way where the patching service(windows service) needs to patch both Non-Domain controllers and Domain controllers. One solution we could think of-
1) First remove the domain administrator privileges on the service account(account_abc
) and create a new service account (account_xyz
) belonging to Domain admin group.
Use the old account(account_abc
) to start the patching process . And then in windows service code, first check if the target server(server to get patched) is a Domain controller( where there is field in SQL database which tells if its a Domain controller or not). If its a Domain controller, then impersonate the further process to new account( account_xyz
) to patch the target server, if not then use old account(account_abc
).
Here I am quite not sure about the impersonation process, how this works in a windows service since already the windows service is running under old account and then how this next patching process needs to be changed to a new service account(account_xyz
)?
I am looking for pointers here, if there is any other better and easy way to accomplish this.
Any idea/suggestion on this would be really helpful.
Thanks