0

We have a patching service which is a windows service that patches the non domain controller and domain controllers. Currently we were using same service account(account_abc) which has a Domain Administrator privilege to patch all the servers

We are planning to remove this privilege due to security reasons. So now we have to come up with a solution for a way where the patching service(windows service) needs to patch both Non-Domain controllers and Domain controllers. One solution we could think of-

1) First remove the domain administrator privileges on the service account(account_abc) and create a new service account (account_xyz) belonging to Domain admin group.

Use the old account(account_abc) to start the patching process . And then in windows service code, first check if the target server(server to get patched) is a Domain controller( where there is field in SQL database which tells if its a Domain controller or not). If its a Domain controller, then impersonate the further process to new account( account_xyz) to patch the target server, if not then use old account(account_abc).

Here I am quite not sure about the impersonation process, how this works in a windows service since already the windows service is running under old account and then how this next patching process needs to be changed to a new service account(account_xyz)?

I am looking for pointers here, if there is any other better and easy way to accomplish this.

Any idea/suggestion on this would be really helpful.

Thanks

4
  • 2
    How is this accomplishing or solving anything? You're essentially replacing one admin account with another.
    – joeqwerty
    Jul 20, 2018 at 20:07
  • You haven't told us much about how the service works, so it is difficult to make any recommendations. But if the service runs on each of the machines being patched, consider using a virtual account rather than a domain account. Jul 21, 2018 at 4:30
  • @HarryJohnston- The service just connects to the target servers using the service account (account_abc) and does the patching on them. Please can you tell me what is a virtual account that you were talking about? Jul 22, 2018 at 13:43
  • See this article, but it might not help much in your scenario. Jul 23, 2018 at 21:43

0

You must log in to answer this question.