Does a Service require to be an Administrator?

[NewsArchive]

Hello all,

here are some questions about the privileges of / for a program, that is meant
to runs as a Service.

Does a Service require to be an Administrator?

Can a service be run or started by a local user?

I came across this article:

-------------------------------------------------------

Don't add service accounts to the local Administrators group
...
Bottom line: Service accounts should have the absolute minimum privileges
needed in order for the server application to run. Whenever possible, use one
of the lower-privileged built-in service accounts: LocalService or
NetworkService. If you must create a new service account, don't make it a
member of the local Administrators group on the server as this will give your
service account too many privileges, potentially increasing the attack surface
of your server.

http://www.windowsnetworking.com/kbase/WindowsTips/WindowsServer2008/AdminTips/Security/DontaddserviceaccountstothelocalAdministratorsgrou p.html

-------------------------------------------------------

The Installer.EXE needs to be set to requireAdministrator in case the
destination is "C:\Program Files".

If installed with Admin-privileges, is the Service then an Admin program, too?

Should a local user be able to stop and start a Service?

I plan to have a Service Manager to fiddle with start and stop. I better know
before, whom I give permission to use it.

Those question may have been asked many times before, but I have no idea where
to find. And Auntie Google spits out lots of trash about this topic. Or I have
asked the wrong questions.



Thanks in advance!
Wolfgang Orth
www.odata.de






.

[NewsArchive]

Wolfgang,

At a minimum, a service needs to be run as an account that has the Log on as
a service user right (pic).

You can set that manually. (In the Windows NT 4 days you HAD to set it
manually.) When you use in the Windows Services manager to specify an
account for a service, you'll get a popup telling you that Windows has
politely given that user that right.

Beyond that, I'd agree with the premise of the article. Since Vista,
Microsoft has been urging that users (including services) run with the
lowest necessary privilege level.

Your service is not an "admin program" just because your installer is
requireAdministrator. Your service will have whatever privileges that the
account it is using (local service, a specific user account, etc.) has.
Many of my SQL Agent jobs require access to file shares on the network, so I
make certain that the service account used for the SQL Agent is a domain
account. (Of course, in SQL it's possible to configure proxy accounts also
for purposes such as jobs that require network or other privileges... but
using the Agent account proves easier for my co-workers to deal with.)

Services normally require administrator privileges to start or stop.
I don't know how to type this in German, but on a U.S. computer, if I type,
for example,
net stop spooler
I'll get an access denied error... unless my command prompt is run As
Administrator.

HTH
- Auntie Jane ("Tia Juana")