We have a patching service which is a windows service that patches the non domain controller and domain controllers. Currently we were using same service account(account_abc) which has a Domain Administrator privilege to patch all the servers

We are planning to remove this privilege due to security reasons. So now we have to come up with a solution for a way where the patching service(windows service) needs to patch both Non-Domain controllers and Domain controllers. One solution we could think of-

1) First remove the domain administrator privileges on the service account(account_abc) and create a new service account (account_xyz) belonging to Domain admin group.

Use the old account(account_abc) to start the patching process . And then in windows service code, first check if the target server(server to get patched) is a Domain controller( where there is field in SQL database which tells if its a Domain controller or not). If its a Domain controller, then impersonate the further process to new account( account_xyz) to patch the target server, if not then use old account(account_abc).

Here I am quite not sure about the impersonation process, how this works in a windows service since already the windows service is running under old account and then how this next patching process needs to be changed to a new service account(account_xyz)?

I am looking for pointers here, if there is any other better and easy way to accomplish this.

Any idea/suggestion on this would be really helpful.


  • 2
    How is this accomplishing or solving anything? You're essentially replacing one admin account with another. – joeqwerty Jul 20 '18 at 20:07
  • You haven't told us much about how the service works, so it is difficult to make any recommendations. But if the service runs on each of the machines being patched, consider using a virtual account rather than a domain account. – Harry Johnston Jul 21 '18 at 4:30
  • @HarryJohnston- The service just connects to the target servers using the service account (account_abc) and does the patching on them. Please can you tell me what is a virtual account that you were talking about? – WonderHeart Jul 22 '18 at 13:43
  • See this article, but it might not help much in your scenario. – Harry Johnston Jul 23 '18 at 21:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.