Re: How to Stop a Service From Impersonating Other Users

From: Will (DELETE_westes_at_earthbroadcast.com)
Date: 11/24/05 

Date: Thu, 24 Nov 2005 03:04:59 -0800

Can you provide more details about what a service requires to do
impersonation? If it has your SID alone, is that enough? The service
doesn't require your password? 

-- 
Will
"S. Pidgorny <MVP>" <slavickp@yahoo.com> wrote in message
news:uCahHVN8FHA.3660@TK2MSFTNGP09.phx.gbl...
> you cannot - SYSTEM account can impersonate other users. Change the
service
> account to one without "Act as a part of the operating system" right.
>
> -- 
> Svyatoslav Pidgorny, MS MVP - Security, MCSE
> -= F1 is the key =-

Relevant Pages

  • Re: system user
    ... > Look for "Client impersonation" in the SDK documentation. ... >>>LOCAL SYSTEM account (though now that I look I don't see anything like ... Then have the LOCAL SYSTEM process ...
    (microsoft.public.development.device.drivers)
  • Re: system user
    ... Look for "Client impersonation" in the SDK documentation. ... LOCAL SYSTEM account (though now that I look I don't see anything like ... Then have the LOCAL SYSTEM process ... I'm guessing that the reasoning for not letting SYSTEM have access to ...
    (microsoft.public.development.device.drivers)
  • Re: system user
    ... Look for "Client impersonation" in the SDK documentation. ... Hence it is usually referred to as the LOCAL SYSTEM account (though now that I look I don't see anything like that in the user namespace... ... Then have the LOCAL SYSTEM process impersonate that user when trying to access the file. ... I'm guessing that the reasoning for not letting SYSTEM have access to ...
    (microsoft.public.development.device.drivers)
  • Re: Using ImpersonateLoggedOnUser
    ... >using the .NET API, ... >> service in order to perform impersonation for the ... >> still using the local SYSTEM account, ... >> does not have access to printers (unless the registry is ...
    (microsoft.public.dotnet.framework)
  • Re: Forms Authentication and Impersonation
    ... > I am trying to use impersonation for part of my site. ... > download them. ... The anonymous user will not have rights to the ... as long as you don't use the system account and set ...
    (microsoft.public.inetserver.iis.security)