Section 5: Service Accounts

The Big Picture: Which Badge Does the Worker Wear?

In a hotel, the manager has a master key. The cleaner has a key to rooms only. The gardener has a key to the garden only. Giving everyone the master key would be dangerous: if one worker is a thief, they can go anywhere.

Windows works the same way. Every service runs under an account: an identity that decides what files, settings and network resources it may touch. This is called its logon account or service account. In the registry it is the ObjectName value (Section 2.2). In services.msc it is the Log On tab.

Why it matters most: If a service is attacked (for example through a bug), the attacker gets that service's power. A service running with a small badge is far safer than one with the master key. This is the principle of least privilege: give only the power that is needed.

Power ▲
      │  LocalSystem          ← master key, most dangerous if attacked
      │  Custom admin user
      │  NetworkService       ← limited, can use the network as the computer
      │  Virtual account      ← limited, one identity per service
      │  LocalService         ← limited, no network identity
      └────────────────────────────────────────────────────────────

5.1 Local System (Full Privileges)

What it is: The account NT AUTHORITY\SYSTEM, shown in service tools as LocalSystem. It is the most powerful account on the PC.

Who uses it: services that need deep access, such as the Print Spooler in its default setup, Plug and Play, and many system components. services.exe itself also runs as SYSTEM.

Risk: If a LocalSystem service has a bug that lets an attacker run code, the attacker owns the whole PC. Because of this, Microsoft keeps moving services to weaker accounts when possible.

See which services use it:

Get-CimInstance Win32_Service | Where-Object StartName -eq 'LocalSystem' | Select-Object -First 10 Name, State

5.2 Network Service (Limited, Network Access)

What it is: The account NT AUTHORITY\NetworkService, shown as NetworkService. It has low rights on the PC, but when it uses the network it presents the computer's identity.

Examples: the DNS Client service and other network-related helpers (the exact account of each service can differ between Windows versions, so check with sc qc).

Real-world analogy: a delivery driver who carries the company's letterhead (he can speak for the company outside), but only has a key to the delivery door.

5.3 Local Service (Limited, No Network)

What it is: The account NT AUTHORITY\LocalService, shown as LocalService. It is the least powerful of the three built-in service accounts.

Examples: Windows Audio and the Windows Event Log (checking with sc qc on your own PC is the safest way to confirm).

Comparison table (the three built-in accounts):

Check any service's account:

sc qc W32Time

Look at the SERVICE_START_NAME line.

5.4 Custom User Accounts for Services

What it is: You can make a service run as a normal user account (local or domain) that you choose. This is common for third-party programs, such as database servers or business software.

Why do this. You can give that account exactly the folders and network shares it needs, and nothing more. If the service is attacked, only those resources are exposed. It also lets the service use named rights on other servers.

What it needs:

Set it in services.msc: double-click the service, Log On tab, choose This account, type the user and password. (Changing this is a real configuration change; do not do it on services you do not own.)

Two better options than a normal user account:

Virtual account example. Many services run as NT SERVICE\<name>. You can spot them in the SERVICE_START_NAME line of sc qc. The point: each service gets its own identity, so you can grant file access to one service without granting it to others.

Warnings:

• Avoid running third-party services as LocalSystem just because "it always works".
• Never use a domain administrator account for a service.
• If a service stops after a password change, check error 1069 and re-enter the password.

Real-world analogy: a contractor with their own badge, who can only enter the rooms you listed in the contract.

Summary

Rule: Run each service under the weakest account that still lets it do its job.