up vote 2 down vote favorite
share [g+] share [fb]

I am attempting to reconfigure the Windows 7 group policies on a laptop using the Local Group Policy Editor. Several of the fields for User Rights assignment are giving me trouble (Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> User Rights Assignment).

Whenever I remove LOCAL_SERVICE or NETWORK_SERVICE from the security setting of some of the fields---it comes right back when I restart the Local Group Policy Editor!

This is happening on Fields like "Change the system time" and "Create global objects". I would like to change these to adminstrator or none, but the policy editor keeps bringing them back the defaults or simply adding LOCAL_SERVICE and NETWORK_SERVICE back in.

Ideas?

link|improve this question
83% accept rate
1  
I would not alter those settings if I were you. Especially without proper knowledge of what those accounts do. You'll likely break your OS installation. – surfasb Dec 3 '11 at 17:58
feedback

1 Answer

up vote 2 down vote accepted

Windows Vista/Server 2008 introduced the notion of required privileges for (some) rights, for example "Change the system time" requires the "Local System" to have access.

This is due to the service hardening introduced in Vista/2008, and the removal of a user's ability in to be in Session 0, so they need these rights to be there so that the OS will run properly.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.