Service account

Modern security practices recommend running services under accounts with minimal privileges. Global daemons can run under non-admin accounts if granted permissions to access WCF endpoints. For permission assignment, see Run the Global daemon without admin privileges.

Global versions before 3.11.3 install services using the built-in Windows Local System account, which has administrator-like privileges. From version 3.11.3, services install by default with the built-in Network Service account, which has fewer privileges than Local System.

Override the default account by including username and password in the install command. This can be a standard user or a built-in Windows account (Local System, Network Service, Local Service). Built-in accounts do not require a password.

Note: When running the service in debug mode, it uses the logged-in user account or administrator account if the command prompt runs in admin mode. It does not use the account that was used to install the service.

Examples

Install single project service with Local System account:

DemonServiceSingle /user .\LocalSystem /install /project APS /location "C:\Program Files\AVEVA\GlobalServer3.11\Singleds.bat"

Install multi-project service with a standard user account:

DemonServiceMulti /user test.user@aveva.com /password test123 /install /location "C:\Program Files\AVEVA\GlobalServer3.11\Singleds.bat"

Note: By default, standard domain users do not have permissions to manage, start, or stop services. However, they can be granted access to manage services through various Windows tools and commands. For more information, refer to the Microsoft article Grant users rights to manage services.