My company is looking to install a 3rd party application on our infrastructure and this application will be installed on an IIS Server with a connection to a SQL server. They require an AD service account with the following permissions, some of which look sketchy to me. What would the risk be of giving an account such permissions, given if a malicious actor compromised the account they could do the following:
- Full read write permissions to specific application folders - not an issue.
- Read and logon to SQL Server - not an issue.
- Must be able to start services - ending services would be a worrying, but any risks associated with starting services?
- Starting .exe files - again need to investigate why, but I would assume starting .exe files would potentially allow a malicious user to execute malicious .exe files if the service account was comprimised?
- Run .bat files - any thoughts?