Welcome to IT Free Training video on service accounts.
In this video I will look at service accounts and how to configure and use them in your
organization. After you finish watching this video you will understand how a service account
can increase security in your organization. This video only looks at how to use and configure
a service account. If you start using service accounts in your organization, you may want
to look at ways to manage these services accounts. In the next video I will look at ways of managing
services accounts and some of the new features in Windows 7 and Windows Server 2008 R2 which
make managing services accounts a lot easier if the software you are running supports them.
What is a service account? A service account is created to run a particular service or
application. This is done following the principle of least privilege.
Least privilege is giving the user only the minium rights and permissions required. For
example, if a service account is created for file replication it does not require rights
to install software. A service account that is created to run a web server does not require
access to change system settings. Following the principle of least privilege, a user account
with just the right amount of access is created as a service account. The advantage of this
is that if the user account used for the service account was to become compromised, the damage
that could be done using that service account is minimized.
To understand a bit better why a service account is required, let’s look at what happens
when a service account is not used. For this example, let’s say you have 3 exchange servers
running on the network, 2 web servers and 1 server with a 3rd party application. When
software is installed it is not uncommon for the software to ask for a username and password
that will be used to run that software. In order to get the software to work, a lot of
administrators will simply enter in a user account that has domain administrator access.
There are a number of problems with this approach. First, when the password is changed, the
password will need to be changed on all the servers that are using that user account.
For this example, let’s say that all the passwords were changed on all servers except
the server running the 3rd party application. What would happen here is the server running
the 3rd party application would still be using the old password and would attempt to authenticate
using it. Since the password is incorrect it would prevent the 3rd party application
from running. The second problem is that since the server is using the old password, could
this cause the account to become locked due to incorrect password attempts?
If the account was to become locked, it would also affect other services and applications
using that account on the network. An administrator would need to make sure that all software
and services using that account had the password changed otherwise just one of these services
could cause the account to become locked and other services and applications could be affected.
After service pack 1 for Windows Server 2003, Active Directory checks the password given
with the last two passwords used for that user account. If there is a match, Active
Directory assumes that an old password is being used and thus does not lock the account.
This helps prevent one service or application bringing down other applications on the network
when user accounts are shared between different systems. In the olds days before this feature
was introduced, a locked user account caused a lot of frustration to the administrator
trying to track down the one location that was stilling using the old password. This
is essentially the kind of problems that you have when you put all your eggs in the one
basket so to speak.
The next problem is that passwords in Active Directory will eventually expire. When the
password expires, the user account cannot be used until the password has been changed.
If all of your essential services are using the same service account and it expires, this
will cause all the software to stop working.
I will now change to my Windows Server to look at how to create and use a service account
on that server and look at how we can address some of these problems.
This server is not a domain controller but has Active Directory administrative tools
installed so I can perform Active Directory Administration. To do so, open Active Directory
Users and Computer from the start menu.
Since this server is not a Domain Controller, I will get a message telling me that in order
to edit local groups and users I need to use the local users and groups tool not the Active
Directory Users and Computers tool.
Once I press ok this server will automatically connect to the closest writeable Domain Controller.
To create the service account, I will expand down to users, right click users and select
new user to launch the new user wizard.
The service account that I am going to create is for software called CWRSync. CwRSync is
software that allows file replication with a protocol called RSync often used by Unix
based operating systems. For the name I will used CWRSync and for the logon name CWRSyncService.
Adding Service to the end will help identify the account as being used for service rather
than being a standard user account.
Once I move onto the next screen, I need to enter in a password for the account. Make
sure the tick box “user must change password at next logon” is not ticked. If this is
ticked, the service account will not be able to be used until the password is changed.
Normally this would occur when the user logs in, but since this account is a service account
is may never happen.
Depending on your needs, you can also tick the tickbox “user cannot change password”.
If someone does login using the service account, which is sometimes possible depending on the
application, this will stop the user from changing the password. The only way the password
can be changed is by an administrator using admin tools such as Active Directory Users and
Computers.
The next option, password never expires, you will want to tick to ensure that the service
account does not expire because of the password policy of the domain. Ticking this option
means that you will need to ensure that the password is changed regularly to maintain
good security.
I will now finish the wizard to create the new service account. Next I will create a
new group to put the service account in. I will do this by right clicking users and select
new group.
In this case I will call the group Service Accounts since I will only put service accounts
into this group. Remember, service accounts are really only user accounts. Since this
group will only contain users I will select the group scope as global.
To add the CWRSync service account to the group, right click on it and select properties
and then from the properties select the tab “member of”. Once I press “add” I
can enter in the Service Accounts group to make this user account a member.
Each user account must have a group configured as a primary group. Now that two groups are
associated with this user account, I can change the primary group to Service Accounts and
remove Domain Users.
The Service Account group does not have permissions assigned to it and it never will. Creating
the Service Account group means that the service account can be assigned to only this group
meaning it will not have any permissions or rights, not even domain user rights since
the domain users group was removed.
Now that the service account has been created in the domain, I will exit out of Active Directory
Users and Computer and open “edit local users and groups” from the start menu.
To give the service account administrator rights on this computer, open “groups”
and right click “administrators” and select “add to group”. This may be more access
than required and you will need to do your own research to determine how much access
a particular piece of software requires. Remember however, access for this service account has
been limited to only this computer. Still better than using the domain administrators
account.
Once I press “add”, I can enter in the user account name that I used for the service
account. Since the account is a domain account, Windows will prompt for a domain account to
access the domain to retrieve information from the domain.
Notice now that the CWRSyncService account has now been added to the local administrators
group.
I will now exit local users and groups and install the software that I created the service
account for. I will skip past the welcome, license and install location screens. Some
software you will install will prompt you for the service account username and password
when installed. This can normally be changed after the install. In this case I will accept
the default service account so I can show you how to change it later.
The software will now install. Once it is complete, I want to configure the service
for this software to use the service account that I created in Active Directory. To do
this, open services from the start menu.
In this case, the software created a new service called RSyncServer. To change the user account
that is used to run this service to the service account that I created, right click the service
and open the properties.
For some software, it is just a simple matter to change the user account that is used to
run the service. Other software may be more complicated and not as simple as changing
the username of the service. You will need to refer to the documentation for the software
that you are configuring to work out how to change the user name for the service account
that you are using.
To change the user account this service is using, select the log on tab. Press the browse
button and then select location since by default only the local security database will be searched
and the service account exists in the domain.
Once I select “entire directory” and go back to the last screen, I can enter in the
user account I created to be a service account for this service, in this case CWRSyncService.
You can see the CWRSyncService has been added. I now need to enter in the password or the
service will fail to start. If the password were to change, I would need to come back
here and enter in the new password.
Once I press “apply”, Windows will give you a dialog telling you the service account
has been given the log on as service right. This essentially means the password was correct
and Windows will let this service account be used to run this service.
If I go back to the general tab, I can now press start and the service will now be started
using the service account that I created.
As shown, the process of creating a service account is not that time consuming, but configuring
one for each server and service on your network can become quite time consuming on a large
network. The process of changing the passwords can also become quite time consuming and difficult
to manage. You can start to see why there is a big temptation to use the one domain
administrator account for all the services in the domain. Using one domain administrator
account means separate accounts do not need to be created. Also using the Domain Administrator
means all services and applications will have no problem running; however this gives them
a lot more rights than what they need.
Let’s review service accounts. A service account is a user account that has been created
to run a particular service or software. The password for the user account should be configured
to not expire to prevent outages. The user account should also be given the minimum amounts
of rights and permissions following the principle of least privileges.
Passwords should be changed regularly to keep security high. In a large environment this
will start to become a lot of work, but this is the price to be paid for good security
and a stable environment.
In the next video I will look at ways to help automate the use of service account in your
company. Windows 7 and Windows Server 2008 R2 come with some new features which help
with the management of service accounts in your organization and offer a new way to create
service accounts that gives better security.
I hope you have found this video informative. More videos are available for this free course
and others on our web site and our YouTube channel. Thanks for watching.