2

Our Apache installation is currently running as the default LocalSystem account on a windows server. We need to give Apache read and write access to a directory on a network share and as LocalSystem doesn't appear in the list of users on the network when we go to give permissions, I was going to change the user Apache is running as to another account on the server and give that account permissions to read/write to the network share. Is this the correct approach when dealing with granting permissions for Apache on Windows? This is the first time I'm dealing with permissions for network drives so I just want to make sure I'm not going to fall into any pitfalls doing this approach. Thanks.

1

I found the answer in the Apache documentation. Duh.

By default, all Apache services are registered to run as the system user (the LocalSystem account). The LocalSystem account has no privileges to your network via any Windows-secured mechanism, including the file system, named pipes, DCOM, or secure RPC. It has, however, wide privileges locally. Never grant any network privileges to the LocalSystem account! If you need Apache to be able to access network resources, create a separate account for Apache as noted below.

  • If this is a domain environment, consider using a managed service account rather than an ordinary user account. This is exactly the scenario managed service accounts were designed for. – Harry Johnston Sep 7 '18 at 23:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.