We have a patching service which is a windows service that patches the non domain controller and domain controllers. Currently we were using same service account(
account_abc) which has a
Domain Administrator privilege to patch all the servers
We are planning to remove this privilege due to security reasons. So now we have to come up with a solution for a way where the patching service(windows service) needs to patch both Non-Domain controllers and Domain controllers. One solution we could think of-
1) First remove the domain administrator privileges on the service account(
account_abc) and create a new service account (
account_xyz) belonging to Domain admin group.
Use the old account(
account_abc) to start the patching process . And then in windows service code, first check if the target server(server to get patched) is a Domain controller( where there is field in SQL database which tells if its a Domain controller or not). If its a Domain controller, then impersonate the further process to new account(
account_xyz) to patch the target server, if not then use old account(
Here I am quite not sure about the impersonation process, how this works in a windows service since already the windows service is running under old account and then how this next patching process needs to be changed to a new service account(
I am looking for pointers here, if there is any other better and easy way to accomplish this.
Any idea/suggestion on this would be really helpful.