1

Are there any risks to running a service as the admin (and login) user on a Windows 10 machine? For instance, will the password be stored on disk in a manner accessible to someone with physical access to the machine? Obviously there is the risk that the service may run code as the user, too, but I don't know if that would be worse than running as SYSTEM.

As for why I'd want to do this, I have several hundred gigabytes of files encrypted with EFS, and I would like to back up these files. This requires that the backup service be able to read the files, which it cannot due to the SYSTEM user not having the appropriate certificate. Adding the certificate for the SYSTEM user to these files would be rather suboptimal, as that certificate is essentially not encrypted at rest - which then removes any protection EFS might provide. Running the backup service as the user in question allows access to the files.

2

Specifying a user account for running a system service requires specifying the password.

The account data is stored as LSA Private Data in the registry under key HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets\_SC_<ServiceName>. Access to this key is rigidly controlled and is not easy and the data is also encrypted. It is impossible to access even for administrators.

Nevertheless, the data can be hacked, although only by a very knowledgeable person. See for a forensic treatment the article of Use PowerShell to Decrypt LSA Secrets from the Registry.

My personal opinion is that the protection is good and the password is safe enough. If anyone with that much knowledge manages to gain that level of control over your setup, then service passwords are the least of your worries.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.