Re: Default privileges of NT Authority\Local Service account?

From: OShah (shexec32_at_aol.com)
Date: 07/11/05

  • Next message: greatx: "Re: How to verify a SignedData (CMS, RFC3369) object?" 
    Date: Mon, 11 Jul 2005 14:43:32 -0700

    =?Utf-8?B?QmVycnkgYXQgSlNP?= <6399bwmNOSPAM@community.nospam> wrote in
    news:4797C6D1-BC69-40B6-AFF7-40B087ADD19A@microsoft.com:

    > What are the default privileges of the NT Authority\Local Service
    > account? I have looked at the privilege membership in Local Security
    > Settings, and it appears that these are its rights:
    > 1. Adjust memory quotas for a process
    > 2. Generate security audits
    > 3. Replace a process level token
    >
    > Is that right? It seems like it should have more privs.
    >
    > Also, does the account have any NTFS permissions on the local drives?
    >
    > The reason I ask is that I want to create a domain account that has the
    > same local rights on the machine.
    >
    >

    Berry,

    Your LocalService/NetworkServices seem normal (nothing out of the
    ordinary).

    The LocalService account is designed to run with few privileges: the idea
    being if you don't need these privileges, then you can run as a less
    privileged account. It's pretty much the same reason why you should run as
    a limited user instead of an administrator.

    According to http://msdn.microsoft.com/library/default.asp?
    url=/library/en-us/dllproc/base/service_user_accounts.asp ,
    those are the only three privileges the account is supposed to have.
    According to the same page, the NetworkService/LocalService accounts are
    members of the Users group [and therefore, Authenticated Users]. This
    means anything that applies to Users (privileges, ACLs, etc.) also applies
    to the services.

    Note that the LocalService/NetworkService accounts cannot display windows
    or dialog boxes (except message boxes). 

    -- 
------------------------------------------------------------------------
oshah [shexec32]
Control Panel -> System -> Advanced -> Error Reporting -> Choose Programs
-> Do not report errors for these programs:
Acrobat.exe
waol.exe
------------------------------------------------------------------------
  • Next message: greatx: "Re: How to verify a SignedData (CMS, RFC3369) object?"

    Relevant Pages

    • Re: How to manage user access in FM7 and later
      ... > profiles and then use this groups to assign rights in FMP. ... > personal login system and a users file where a rights manager could ... > Take into account that the delegated rights manager knows nothing ... about everything you can do with homebuilt, individual privileges can be ...
      (comp.databases.filemaker)
    • Re: How good is Comodo Internet Security?
      ... the process will have the same privileges as that token. ... the token has the limitation of a standard user account, ... limited and you get more protection. ... They don't want to use a limited Windows account. ...
      (comp.security.firewalls)
    • Re: How good is Comodo Internet Security?
      ... the process will have the same privileges as that token. ... the token has the limitation of a standard user account, ... use them to start the web browser, that instance of the web browser is ... limited and you get more protection. ...
      (comp.security.firewalls)
    • Re: How good is Comodo Internet Security?
      ... Since the token has the limitation of a standard user ... account, ... the child process under limited privileges, ... do out admin task within our LUA enviroment? ...
      (comp.security.firewalls)
    • RE: AcquireCredentialsHandle failures with Least Privilege
      ... to restrict it's privileges, so that if it is compromised ... The process first restricts it's privileges and then sets ... the privileged group account ACLs to DENY ONLY. ... How can I NOT use a privileged LUID, ACL or other ...
      (microsoft.public.platformsdk.security)