What does service account really mean and what impact on the service itself it has?
It's how the service "logs in" to the OS.
In services it mainly exists for security purposes, but it still means the same thing as regular user accounts mean to programs: it defines what access to the system you'll have.
For example, the folder C:\Users\Ringger81 has "access control lists" which say that user Ringger81 can read & change those files, but other users cannot. So if you log in to Windows as Ringger81 you get access to those files, but other accounts (e.g. family) won't have any.
If a service is running as user Ringger81, that works exactly the same way.
(Not only files have ACLs, but also processes, devices, registry keys, printers, ... many other kinds of objects. That's why Windows has Users and Administrators, as well as the "Do you want allow this app to make changes" prompt.)
What is the sytntax of field "This account"? For g.e. what does NT AUTHORITY\LocalService means?
In all of Windows NT series, user accounts are named like <DOMAIN>\<username>. The domain describes where the account comes from, and can be:
- On standalone (workgroup) PCs, it's the computer name – since each computer has its own user accounts.
- On domain-joined (Active Directory) PCs, local accounts are the same as above, but domain accounts are of course prefixed with the AD "short domain name". So the same computer could have
JOES-PC\Joe (local) and MYCOMPANY\Joe (from AD).
- The special domain
NT AUTHORITY is for various built-in accounts that come with every Windows installation. For example, NT AUTHORITY\SYSTEM is the most privileged account (even above Administrators) and is used by core Windows services. NT AUTHORITY\LocalService is similar but slightly restricted.
- The shortcut
. (e.g. .\Joe) means a local account on this computer; the dot gets replaced by the computer name.
Can You provide an example case for setting Log on as propery to specified user account (for e.g. "Mark" user) instead of default Local system account?
Letting services run as "Local System" can be risky. They have full unrestricted access to the computer (again, even more than Administrators).
Let's say you install the Apache web server (via XAMPP or whatever) and configure it to host a small website. In the past, both Apache itself and popular website platforms (such as Wordpress) have had plenty of bugs letting a visitor modify files they shouldn't, or even trick the website into running programs/commands on the server.
If Apache were running on its own dedicated account, the damage would be limited to what its account can do: a hacker could perhaps delete the website's files or disable Apache entirely, but nothing more. If they installed malware, it would be easy to clean up.
But if Apache were running as "Local System", a hacker finding a security hole could do anything to the server, e.g. steal your personal files, lock you out entirely, or even delete the entire disk's contents.
Note that the example above has a dedicated account, since it provides the most protection. Letting services run under a "human" account is not very useful.
