At.exe Service Account - scripted or registry?

From: ATarasul@SpencerStuart.com
Date: 01/24/03

  • Next message: Hall, Randy: "RE: Bypass Traverse Checking?" 
    Date: Fri, 24 Jan 2003 12:36:06 -0600
From: <ATarasul@SpencerStuart.com>
To: <focus-ms@securityfocus.com>

    There is a trick to set "AT Service Account" to existing account , but
    wrong dummy password - front end validation validate only account name.
    In this case jobs scheduled with "at" - assuming attacker managed to run
    at - will not be able to execute.
    Any idea how to do this in script or by writing to registry to
    distribute through template/policy?

    Thanks
    Alexander

    Microsoft How-to is:
    Open Control Panel and double-click Scheduled Tasks.
    In the Scheduled Tasks window, open the Advanced menu and then choose AT
    Service Account.
    Click This Account and specify a particular user and password. Click OK.

    Relevant Pages

    • RE: service account migration
      ... You failed to migrate password of service account or all user account? ... To enable support for password migration: ... Part II: Source Domain ...
      (microsoft.public.windows.server.migration)
    • Re: 2005 Enterprise sp 2 install fails - 11009
      ... Q...Was your SQL Server service account a domain administrator account? ...
      (microsoft.public.sqlserver.setup)
    • RE: COM+ Identity Win2K->Win2003
      ... Here is the description of Local Service and Network Service account. ...
      (microsoft.public.windows.server.migration)
    • Oddball setup
      ... attempting to open or create the physical file 'H:\LOG\mdb_log.ldf'." ... I can setup the service account to use my login, or I can try local account ... If this machine were not actually behind the firewall but in front of it (if ...
      (microsoft.public.sqlserver.setup)
    • Re: Can anyone get me out of SSPI / Kerberos / NTLM hell ???
      ... One time only, for the service account: ... to allow SQL Service startup account to register spn ... Shouldn't being part of the Domain Admin group supply sufficient ...
      (microsoft.public.sqlserver.connect)