Questions tagged [service-accounts]
The service-accounts tag has no usage guidance.
79
questions
0
votes
0
answers
8
views
Must all services of ADCS run under the same service account on the same server?
While deploying ADCS, on the documentation Microsoft recommends using service accounts for the services making up ADCS. The problem is that it doesn't address if these should be individually managed, ...
- 111
0
votes
1
answer
36
views
Pod assigned node role instead of service account role on AWS EKS
First some info about the setup:
EKS version: 1.21
eksctl version: 0.77.0
AWS Go SDK verion: v1.44.28
Deploying using kubectl
I have a k8s cluster on AWS EKS on which I am deploying a custom k8s ...
- 111
1
vote
1
answer
338
views
Display Existing Policy Bindings for GCP Service Account
I'm setting up a service account to access a CloudSQL DB from GKE. I've created both the GSA and the KSA, and have executed the command to associate the two (gcloud iam service-accounts add-iam-...
- 13
1
vote
0
answers
146
views
MS SQL server 2019 failover cluster - Event ID 18456, Login failed for user 'domain\server1$'
New MS SQL server 2019 installation on Windows Server 2019, failover cluster role enabled; fully patched Windows, SQL 2019 CU 11.
Nodes:
server1 - 10.10.10.1
server2 - 10.10.10.2
Instances:
sql1
sql2
...
- 1,539
2
votes
2
answers
2k
views
How do I Generate a Bearer Token for cURL to Get Thru IAP (GCP)?
I need to cURL a web app hosted behind IAP on GCP.
Normally, users log in through IAP and use the web app, but I need to run some cURL commands (interactive and non-interactive) that hit the web app ...
google-cloud-platform
0
votes
1
answer
2k
views
Accessing BigQuery data from different project in same organization with a Service Account
I'm having some serious trouble getting the official BigQuery client (in Python 3) to a different project in the same organization authorized from a Cloud Run service.
The Cloud Run service is in ...
1
vote
0
answers
819
views
Group Managed Service Account access to network share on remote server
We've got a service running using a Group Managed Service Account on a Windows Server 2016 host (HostA).
We're extending the functionality of this service so that it runs an R script which needs to ...
- 131
2
votes
1
answer
2k
views
Sudden permissions denied for service account
I Have a ServiceAccount that has permissions to do all sort of things on my GCP project, and a Jenkins pipeline that runs on nightly basis and shutdown one of my GKE environments.
Few days ago i've ...
0
votes
1
answer
9k
views
Access denied (SA doesn't have storage.objects.create access) when trying to upload using a preSigned url to google cloud storage
Having issues trying to allow a client to upload a file via a presigned url.
Error received
<?xml version='1.0' encoding='UTF-8'?>
<Error>
<Code>AccessDenied</Code>
<Message&...
1
vote
1
answer
232
views
Can I store certificates in the personal store of a virtual service account?
We'd like to make use of virtual accounts (https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd548356(v=ws.10)?redirectedfrom=MSDN#using-virtual-...
- 113
2
votes
1
answer
147
views
VM instance down suddenly and fail to restart, showing 'serviceAccount' was not found [closed]
I have a Django server running in VM instance, the server working fine before this, but this morning the server was unable to access. So I tried to SSH into the VM instance, but it took a long time ...
0
votes
1
answer
1k
views
Running powershell as service account without logon privilege
I'm trying to run a powershell script as a service account via task scheduler. It has to run as the service account (rather than the local system) to get required permissions to do some of the tasks.
...
- 166
0
votes
0
answers
52
views
IIS Worker doesn't run or crashes immediately
We have an IIS app hosted on Windows 2016 Server which runs fine, when running as Local User or Network Service. One of the customers is setting up the application to run on a Service Account (...
- 29
0
votes
1
answer
41
views
Can a service account access all APIs?
For an api-key, one can define which APIs can be accessed with that api-key, but for service accounts, you seemingly can't. I thought maybe I could create a new role that only allows access to the ...
1
vote
1
answer
865
views
Google Admin SDK authentication with service account
My team is currently developing an application to list my company's domain users in GCP, using the Admin SDK, for onboarding and offboarding purposes.
We're using a service account to do this and we'...
0
votes
1
answer
92
views
Deploying Deep Learning VM - default service account couldn't be detected
I am trying to deploy a deep learning VM (via the marketplace) However I get an error - that there is no valid default service account available. I have tried the following options
disabling & ...
0
votes
1
answer
435
views
Logon as a service for virtual accounts
I have a Windows Internal Database installation running with its default settings. I have the required "Logon as a service" permissions configured as follows:
Administrators
ALL SERVICES
LOCAL ...
- 49
0
votes
2
answers
999
views
Unable to export service account key in Terraform #GCP
I have downloaded the GCP service account key to my local system. In Terraform, I have set the GOOGLE_APPLICATION_CREDENTIALS as a path to this file in the startup-script part of my bastion instance. ...
2
votes
2
answers
6k
views
ERROR: (gcloud.auth.activate-service-account) Could not read json file /root/gcloud-service-key.json: No JSON object could be decoded
I'm getting the below error when running CI/CD pipeline in GitLab.
$ echo "$GCLOUD_SERVICE_KEY" > ${HOME}/gcloud-service-key.json
$ gcloud auth activate-service-account gitlabci@bizao-hub.iam....
- 121
0
votes
0
answers
25
views
What sort of authentication is a windows machine local group with a domain user added to it?
I went and looked at a service that was run by a domain user.
The process for the service read from a file on the machine's hard drive, and in the ACLs for that service there was an ACE for the local ...
- 4,777
0
votes
2
answers
7k
views
Service account does not have storage.buckets.create access
I have created a Service Account for Terraform. Apart of our process is to create some storage buckets and maintain them through Terraform.
However, when we run terraform apply we get the following ...
3
votes
1
answer
2k
views
How to use JSON keys with google cloud gsutil to manage multiple Keys
We have multiple GCP Service account keys from different environment such as DEV,STAGING,..PROD.
I would like to run a command in my jenkins box which is there in Dev environment to create access DEV ...
3
votes
1
answer
3k
views
Why Domain Admin Cannot Enable Domain Wide Delegation for Service Accounts?
We need to use service accounts for our application instead of individually end users to call some Google Apis such as Admin Directory Api. There are 3 members of this project which are me as owner, ...
1
vote
1
answer
41
views
Windows - Restrict ability to run application to one service account
I've been asked to write a script that enters information from one application into another - and I've done it using a combination of Python, Selenium and Firefox (it's a temporary measure before a ...
- 13
4
votes
2
answers
1k
views
Deploying as service account (using `gcloud app deploy`) gives “API [appengine.googleapis.com] not enabled on project [%id%].”
I am struggling to make automated deployment using a service account work. First I created a new service account and now I am using a default %my-project-name%@appspot.gserviceaccount.com because ...
0
votes
0
answers
109
views
Configure Windows Service user account based on Domain Controller check
We have a patching service which is a windows service that patches the non domain controller and domain controllers. Currently we were using same service account(account_abc) which has a Domain ...
- 101
0
votes
1
answer
590
views
How to monitor service account activities in google cloud platform
I created more than 5 service account in GCP to use Pub/Sub services.
Now, I want to delete 4 of the 5 accounts. But I don't know which 4 accounts are not using, which one is active. I don't want to ...
- 1
2
votes
1
answer
2k
views
SPN generation for multiple service account on a Web server
I am trying to achieve Azure SSO in my organisation. I have a web server hosting multiple websites and web application under those sites. Users access them in below fashion
https:// < SiteName >...
1
vote
1
answer
3k
views
How to provide access to only one instance to users in Google Compute Engine?
I'm trying to find a solution to provide an external worker access to an instance in our project but not all resources.
I have done some research and found two methods on how to do this.
First ...
4
votes
4
answers
4k
views
How to manage logon as service right for virtual account in face of domain group policy?
I would like to use the default SQL Server setup that runs SQL Server service with virtual account NT SERVICE\MSSQLSERVER. That ensures my SQL Server has limited access on its own machine and no ...
- 51
2
votes
0
answers
2k
views
Behaviour of environment variables in HKCU\Volatile Environment reg key
I have a .bat script that runs for every user at login (copies Oracle Java Exception Sites). It copies a file to:
%userprofile%\appdata\LocalLow\Sun\Java\Deployment\security\exception.sites
...
- 21
3
votes
1
answer
998
views
Group Managed Service Accounts per service per server (Best practice?) and long names?
I've talked with a few colleagues about what might be best practice for using group managed service accounts in our environment.
It seems that ideally, we would create 1 gMSA per service (e.g. SQL ...
- 141
4
votes
1
answer
589
views
Giving permissions to Virtual Service Accounts on domain controllers
The service I'm implementing will run on a domain controller, so I'd like it to have minimal privileges.
Ideally, it would simply run as Local Service. However, it needs to be able to:
monitor ...
- 141
12
votes
1
answer
3k
views
Scheduled restart of a service with powerhshell as non-admin service account
Before I get shot down, I know how to schedule a task, restart a service with powershell or give a non-admin account the privileges to restart a service. That isn't the problem. The problem however is ...
- 318
1
vote
0
answers
54
views
vCenter Log on as a Service Concerns
I was installing VMWare vCenter Server 6.0 on Windows Server 2012 R2 when I came across vCenter Server Service Account feature. I can use a local system account or specify a service account on my ...
- 209
1
vote
1
answer
230
views
Why Apache can run a command and root cannot?
I have a server-side script executed by Apache running as www-data. The script runs fine on the server when called remotely (http://example.com/script.sh).
I am trying to run the same script on the ...
- 3,337
0
votes
1
answer
43
views
How can I deny a local (non-domain) user the ability to log on without using group policy?
I have a workstation, running Windows 8.1, that is joined to a domain.
I want to create a local (non-domain) user without the ability to log on interactively. I'd like to avoid Group Policy because ...
0
votes
1
answer
56
views
How to create an account, that can not login?
Our Unix systems rely on corporate AD for authentication and authorization.
We need to create a few "role" accounts, which shall not be able to login themselves, but to which other accounts (...
- 2,252
0
votes
1
answer
4k
views
Cannot schedule task to run as user on Server 2012 R2
I'm trying to create a scheduled task on Server 2012 R2 to run as a domain service account. I select "Run whether the user is logged on or not", and select the domain service account, click on OK, ...
- 611
5
votes
1
answer
2k
views
What are the attributes of a Service Account?
What settings in AD make a service account, a service account?
I know that the login into probably shouldn't be given to anyone but the administrators, that it might be used to run a service, I also ...
- 4,777
1
vote
1
answer
151
views
AIX non-expiring account lock - who is locking it?
I have a non-expiring service account on an AIX server which I use to connect to my database.
Every couple of weeks some user or task tries to connect to the account with the wrong password, and the ...
- 11
2
votes
1
answer
224
views
Who or what needs user "operator" in OSX
Our OSX server 4 Yosemity 10.10 is bound to AD where an unrelated user "operator" exists. Reportedly the OSX server tries to use account "operator" without the proper password, and this action locks ...
- 21
4
votes
2
answers
35k
views
Issue connecting to AD FS configuration database
I just installed the AD FS role on my DC using the Windows Internal Database. All seemed to be fine after I set everything up, however, once I restarted my DC, when attempting to load the AD FS ...
- 53
1
vote
1
answer
795
views
How can I replace a local TFS service account with a domain TFS service account to perform a migration?
I changed the service account used by Team Foundation Server from a local account HOSTNAME\local_tfs_service_account to a domain account DOMAIN\domain_tfs_service_account, by directly clicking on the "...
- 153
3
votes
1
answer
1k
views
Moving Service Accounts to a new OU
I just want to double check before possibly breaking something. I want to move the majority of created service accounts in AD to another OU (doing a clean up). I understand Exchange service accounts ...
- 33
2
votes
1
answer
333
views
howto restrict active directory account for PEAP/non-CIFS only
We have some voip phones that we want to integrate into our PEAP WiFi network, and I'm concerned about just creating a standard AD account and using that. If someone got hold of such long-term account ...
- 181
3
votes
1
answer
677
views
Change service user password in AD running service
I have a running service with logon user credentials using a service account in AD.
If I change the service account password in AD users and groups but not on the service startup/logon details would ...
- 1,120
4
votes
2
answers
7k
views
Network Service account or domain account? [closed]
What are the pros and cons, or best practices when it comes to setting up applications on a server with either the Network Service account or a domain account?
Are there some cases in which you'd do ...
- 855
5
votes
3
answers
6k
views
Setting up Group Managed Service Account on Windows Server 2012 R2
I have a Windows 2012 R2 domain controller called cox.win.testlab. I have set up a group of hosts where I would like to use a gMSA (Group Managed Service Account). This group is called SQLManagedHosts....
- 2,078
2
votes
2
answers
33k
views
AD Read-Only Account (for Authentication)
I have experience with Linux server administration, however when it comes to Windows I'm pretty much a newbie.
I have a lot third-parties applications that use an AD admin account to perform its ...
- 1,321
Related Tags
active-directory × 19
windows × 11
sql-server × 7
security × 6
permissions × 5
scheduled-task × 4
windows-service × 4
best-practices × 4
google-iam × 4
powershell × 3
service × 3
groups × 3
linux × 2
kubernetes × 2
network-share × 2
more related tags
Hot Network Questions
- On what Constitutional basis does the federal government regulate radio?
- Why do we hear frequencies in the basis of sine waves?
- Are black areas on studs of shower surround a concern or usable as is?
- How should I approach my academic dishonesty in graduate study application?
- Is white wire with grey stripes positive or negative wire?
- Maze generator in C
- What kind of "safe" was carried on the Space Shuttles?
- I received a referee report that was not properly redacted
- New AGM 12V battery at 10.8V - charger says it is full
- What is he porpuse of ctrl+alt+f8?
- The FAA is asking for medical records that I don’t want to give. May I refuse?
- Is having root password for sudo considered a best practice or the opposite?
- Critical Point and Triple Point
- Where in the CARs does it say that we need to perform a walk-around each day?
- Why is there only a viiᵒ chord and no vii chord?
- Which is correct - molybdate or molybdenate?
- What are some animals a fifteen year old boy should be able to hunt, easily, in an Early Modern Setting?
- How to get vertical wild menu using wildoptions=pum on Vim 9.0
- What is the limit for pairing batteries in series? What happens if we cross that limit?
- Is it legal for a group of drivers to completely "fill" a roundabout?
- My cows lactate oil instead of milk, how do I stop them from igniting?
- Why do some plants need an "open" position?
- How should we handle interns who are not performing?
- Why are assemblers called assemblers?