Sign in with administrator privileges to the computer from which you want to provide Log on as Service permission to accounts. Go to Administrative Tools, click Local Security Policy. Expand Local Policy, click User Rights Assignment. In the right pane, right-click Log on as a service and select Properties.
These Network Service accounts work much the NT Service accounts except with the exception that the Network Service accounts have the ability to access network resources while the NT Service accounts only have the ability to access resources on the local server.
A service account is a user account that is created explicitly to provide a security context for services running on Windows Server operating systems. The security context determines the service's ability to access local and network resources. The Windows operating systems rely on services to run various features.
User accounts are used by real users, service accounts are used by system services such as web servers, mail transport agents, databases etc. Service accounts may - and typically do - own specific resources, even device special files, but they don't have superuser-like privileges.
How to find NT ServiceMSSQLSERVER and NT ServiceSQLSERVERAGENT accounts?
- Get the properties of the services.
- Easiest way is, just type the account and leave the password blank.
- Click on to get the service restarted.
- Or, if you want to search the account, click on Browse to open Select User or Group window.
In the left pane, right click the GPO you want to edit and select edit. Drill down to Computer Configuration>Windows Settings>Security Settings>Local Polices>User Rights Assignment. You find Log on as a service in the right pane.
a local system account of "local admin" is the same as an admin account. Typically the only time you hear that used is with in a domain setting.
Set it manually: Go to Administrative Tools -> Local Security Policy -> Local Policies -> User Rights Assignment. Edit the item "Log on as a service" and add your domain user there. Also you can use Service Security Editor for a GUI to configure all services. You can set the exact user permissions for each service.
Open SQL Server Management Studio. Connect the SQL instance which is installed on the SQL Server and log on to the SQL Server. Go to Security > Logins. Right-click on NT AUTHORITYSYSTEM and select Properties.
There are actually two versions of Windows NT: Windows NT Server, designed to act as a server in networks, and Windows NT Workstation for stand-alone or client workstations.
The LOCAL SERVICE account is a predefined local account used by the service control manager. It has minimum privileges on the local computer and presents anonymous credentials on the network.
It is possible to check membership! To change membership, is a different story, that is not possible. But to view memberships of "NT AuthoritySystem" you need
psexec.exe.
which will show that "NT AuthoritySystem" is a member of:
- BUILTIN/Administrators.
- Everyone.
- Authenticated Users.
- System Mandatory Level.
Network Services include IP addressing, Domain Name System (DNS), primary domain email service, Internet access, web content filtering, security products such as firewalls, VPN termination and intrusion prevention systems (IPS), and the necessary tools and staff to support these services.
It has minimum privileges on the local computer and presents anonymous credentials on the network. This account can be specified in a call to the CreateService and ChangeServiceConfig functions. Note that this account does not have a password, so any password information that you provide in this call is ignored.
You need to open the Services administrative tool snap-in and open the properties on Microsoft Exchange Transport. Go to the Log On tab, click on This Account and enter NT AUTHORITYNetworkService, then delete any bullets that might appears in both password fields. Stop and restart the service and you should be ok.
When selecting 'Properties' for Network Services in the Services window there's a password shown under the 'Log On' tab. The password is hidden (it only shows dots, not the password itself).
Setting Permissions
- Access the Properties dialog box.
- Select the Security tab.
- Click Edit.
- In the Group or user name section, select the user(s) you wish to set permissions for.
- In the Permissions section, use the checkboxes to select the appropriate permission level.
- Click Apply.
- Click Okay.
The NETWORK SERVICE is a special account that presents the credentials of the computer it is running on to the remote services it connects to.
The Local Service principal is tailored to services that only access local resources and don't need access to other network resources. The Network Service account, on the other hand, is tailored to services or applications that do need access to network resources.
You should be able to change it back by going in to Service Properties and changing "Log on as" to "NETWORK SERVICE" (use "Browse" and it should populate the password fields for you).
Resolution
- Open Active Directory User and Computers.
- From the View menu, select Advanced Features:
- Locate a problem user and open their Properties.
- Select the Security tab, click Advanced then select the Effective Permissions tab.
- Click Select and type NETWORK SERVICE account, then click OK.
