Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I plan on creating a domain user account that will be able to log on as a service, but have only the minimum requirements for this service to function. of course this could be misconfigured, but assuming I don't add a user that has too many privileges are there an inherent security risk involved?

I couldn't find an article about this after doing some googling. If there is an article that someone could link me to, I'd appreciate it.

Thanks.

share|improve this question
add comment

1 Answer

up vote 3 down vote accepted

The user will have access to anything that the Everyone and Users groups have access to, which means it's similar to a guest account. Everything outside user directories and system directories will be readable by default, though some system directories are readable too.

Assuming you appropriately configure the user, there should be minimal risk. However, it is certainly advisable to configure auditing for that user, via local or group policy, in order to ensure that any misuse is logged, so that you can take measures to stop that misuse and make changes to prevent it in future.

This should give you a reasonable standing from a security perspective. That being said, this is actually one of the few areas that I feel the Windows security model is lacking in - i.e. single purpose users that don't automatically have access to anything but a specific set of directories.

share|improve this answer
    
Thank you. What is the risk compared to running as the default Local System account or another service account? –  Tim Sep 23 '13 at 13:38
    
Local System is the same as SYSTEM, which is analogous to root in the Linux world - compromise SYSTEM and you've compromised everything. Other service accounts, e.g. Network Service, have some security benefits (e.g. segregation of access across same-user processes) but are still high-privilege accounts. Using a dedicated user ensures maximum separation and allows for more narrow assignment of minimum necessary privileges, but is obviously more difficult to implement and has more potential pitfalls. –  Polynomial Sep 23 '13 at 13:50
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.