Restricted access for service accounts

For some service account types, the service account that runs the interface can be restricted so that it cannot access sensitive folders, files, and registry keys. Access control for folders and files is performed through property pages in Windows Explorer. Access control for registry keys is performed through regedit.exe.

Service account types can be grouped by the possible restrictions in the following ways:

• Virtual service accounts, non-administrator Domain and Local Service accounts

  Recommended: Restrictions can be configured to individual folder, files, and registry keys.

• Local Service and Network Service accounts

  Limited restrictions can be configured. Accounts are shared by multiple services, including Windows services, which require different levels of access.

• Domain or Local Service accounts in Administrators group

  Restrictions are difficult to configure. Access is required for administrator-level tasks and restrictions are not recommended.

• Local System service account

  Not recommended: No restrictions are possible.

You must allow access to restricted folders and files for service accounts with lower-level privileges. Without adding access for the low-privileged account, the interface will not run properly.