Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I've created a window's service that monitors files on a specific directory on our Windows OS. When a file is detected, the service does some file I/O, reads the files, creates sub-directories, etc. This service also uses database connectivity to connect to another server. My plan is to have the service run as the default "Local Service" account. Since I need to allow write/read privileges, which apparently the "Local Service" account does not do by default, I'm going to explicitly set "Full Control" privileges for the "Local Service" account on the folder that I'm reading/writing to and from.

I believe the above is a good . My question is, for the folder that I'm reading and writing to, do I need to setup a "Network Service" role with full control access? I'm wondering since my service uses database connectivity to another server, if I'll need the "Network Service" account setup.

I may be misunderstanding what the "Network Service" account does.

share|improve this question

2 Answers 2

up vote 5 down vote accepted

The NT AUTHORITY\NetworkService account is only needed when you're communicating with other computers in a domain that need your machine's credentials for access control. It is not required for simple Internet/network access. It is only necessary for specific purposes in an Active Directory domain.

Also the entire point of the NT AUTHORITY\LocalService account is that it has minimum privileges on the system. Giving it more privileged decreases the security of the many services on your system designed to run at the low privilege level it was designed to proffer. If your service requires privileges above and beyond those, you should create a new account for it with the necessary privileges and set that account in the Log On tab of the service's properties. (This can also be done programatically.)

You could also run it using the NT AUTORITY\LocalSystem account, which has the same privileges as an administrative user on your system, but I assume you wanted to use the LocalService account for the increased security it provides.

share|improve this answer
1  
How would giving the LocalService account full-control on one folder (and sub-folders) decrease the security of the other services? –  contactmatt Mar 9 '11 at 7:05
1  
@user19185 It doesn't decrease their security per se, but it does raise the attack profile. If a service running as LocalService is compromised it would have access to anything you opened up for LocalService, whereas ordinarily it would have access to nothing. This has been standard computer security operating procedure since the 70s. –  Patches Mar 9 '11 at 7:19

The previous answer didn't appear to address the questions directly, so I thought I would add to it.

  1. My plan is to have the service run as the default "Local Service" account. I'm going to explicitly set "Full Control" privileges for the "Local Service" account on the folder that I'm reading/writing to and from. I believe the above is a good plan.

Personally, I don't see a big issue with this plan. With BUILTINs, the choice is between:

  1. Running as LOCALSYSTEM - so if this service is compromised, the attacker owns Everything, and immediately.
  2. Running as LOCALSERVICE - so if this service, or any of the many other services running under this account, are compromised, the attacker has access to one extra directory.*

Arguably, adding a few extra ACLs to be able to use the second option is preferable. Yes, the safest option for a low-privilege but highly security-sensitive service would be to run under a custom tailored, low privilege service account. But unless you want to create a new account/manage passwords for every service you deploy, using LocalService for minor non-sensitive tasks is not such a terrible thing. You just need to make a responsible decision based on these considerations, like what is in that directory or that database, impact if they are breached etc.

Although again, per least privilege principle, you should only set Full Control if Modify is really not sufficient.

2.My question is, for the folder that I'm reading and writing to, do I need to setup a "Network Service" role with full control access? I'm wondering since my service uses database connectivity to another server, if I'll need the "Network Service" account setup.

If your database required Windows Integrated/SSPI login, then yes, you would need to use NetworkService (or a domain service account) everywhere, i.e., RunAs and directory permissions. Assuming you also granted your computername$ or domain account access to this database. I doubt you are doing that, so if it uses normal username/pwd authentication, you should be able to do everything with LocalService. You need to grant only one account rights on that directory, whichever you use in your RunAs, not both.

3.I may be misunderstanding what the "Network Service" account does.

LocalService/NetworkService are almost identical accounts on the local computer. The difference mainly is what they can do on the network. NS can access some network resources because it appears on the network as a real (computer) account. But LS will appear as ANONYMOUS, so it will be denied mostly everything on the network.

By the way, you should be using a Scheduled Task for this, not a service.

*From Vista onwards, due to service isolation, one compromised LocalService process cannot easily attack another. Each LocalService/NetworkService service process/instance gets its own unique logon session SID (unique owner), unlike Windows 2003. But I'm not sure this is perfect and fully mitigates the DACL vulnerability on files and resources. Restricted SIDs and write-restricted tokens are mentioned in this context.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.