What rights on a machine does an account have when logging on as a service?

Gurus,

System services usually run under the Local System account or Network
Security account. When you make an account run as a domain user account,
i.e a Domain Admin account, what additional rights does it give that box on
the local machine? I know it gives it the right to logon as a service.
Anything else?

--
Spin

Im not sure if I really understand what you want to know.

But, all Domain Admins accounts are Local Admins for every computer joined
to the domain.

--
augusto alvarez | it pro | southworks
http://staff.southworks.net/aalvarez


"Spin" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> Gurus,
>
> System services usually run under the Local System account or Network
> Security account. When you make an account run as a domain user account,
> i.e a Domain Admin account, what additional rights does it give that box
> on the local machine? I know it gives it the right to logon as a service.
> Anything else?
>
> --
> Spin

"Augusto Alvarez" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> Im not sure if I really understand what you want to know.
>
> But, all Domain Admins accounts are Local Admins for every computer joined
> to the domain.

That isn't what I asked. Thx for taking a stab though.

Spin wrote:
> "Augusto Alvarez" <(E-Mail Removed)> wrote in message
> news:(E-Mail Removed)...
>> Im not sure if I really understand what you want to know.
>>
>> But, all Domain Admins accounts are Local Admins for every computer
>> joined to the domain.
>
> That isn't what I asked. Thx for taking a stab though.

Open the localmachine sercurity policy, expand the computer configuration,
security settings, local policies, user rights assignments....

then look for the rights and accounts of interest.


--
/kj

It depends.

Domain Admins group is added to the Local Administrators group on the
machine. Therefore it has access to everything as does a Local Admin.

Domain Users are added to the local Users group on the machine so therefore
it has the same access as a local user. I restrict my local users even
further than MS does by default by setting NTFS permissions.

Cheers,
Lara

"Spin" wrote:

> Gurus,
>
> System services usually run under the Local System account or Network
> Security account. When you make an account run as a domain user account,
> i.e a Domain Admin account, what additional rights does it give that box on
> the local machine? I know it gives it the right to logon as a service.
> Anything else?
>
> --
> Spin
>
>

It shouldn't give you any additional rights. A user account (Domain or
local) needs to be assigned the right to log on as a service to run but you
have to assign that right it never has any additional rights provided to it
because it runs as a service.

--
Paul Bergson
MVP - Directory Services
MCT, MCSE, MCSA, Security+, BS CSci
2008, 2003, 2000 (Early Achiever), NT4

http://www.pbbergs.com

Please no e-mails, any questions should be posted in the NewsGroup
This posting is provided "AS IS" with no warranties, and confers no rights.

"Spin" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> Gurus,
>
> System services usually run under the Local System account or Network
> Security account. When you make an account run as a domain user account,
> i.e a Domain Admin account, what additional rights does it give that box
> on the local machine? I know it gives it the right to logon as a service.
> Anything else?
>
> --
> Spin