Solved

Have GPO add an account to all domain computers and set 3 services to log on as that account instead of the SYSTEM account.

Posted on 2014-12-05
3
459 Views
Last Modified: 2014-12-12
I am trying desperately to figure out how to have a local account run a service instead of using the SYSTEM account. I need to do this through GPO and I feel like I am either NOT going  to be able to do this or I need to go through a lot of steps to get this working.

So basically, I have 3 services running under the SYSTEM account and one SQL instance running under SYSTEM. I need to change only these to run under a different account and I have to be able to set this all up on 1000 computers via GPO.

I am going to go through the steps that I went through so far.. The issue is when I try to add the account under Computer Configuration | Preferences | Control Panel Settings | Services

I get the Warning: CPassword attribute has been deprecated to minimize security risk. Instead, you should use secure built-in user accounts to create Services Group Policy Preferences.

I kind of understand that the local account that I created is not a built-in account but I cant find a way to do so.

Changes made so far:

Step1
A local group was created on my computer so that I can use it in GPO. I also created the local account.
Local group name: Program Services Group
Members: AppServiceAcct

Local account name: AppServiceAcct
Group: Program Services Group
Added a password
Password never expires


Step 2
GPO location:      
      Computer Configuration | Preferences | Control Panel Settings | Local Users and Groups
Local group created in GPO: Program Services Group
      -Action: Create
      -Add AppServiceAcct under Members



Step 3
GPO Location:
      Computer Configuration | Policies | Windows Settings | Security Settings | File System
All 3 files that run as a service had the following permissions added/modified via GPO:
New Settings:
Authenticated Users
      Read & Execute
        Read
SYSTEM
      Read & Execute
        Read
Administrators
      Read & Execute
        Read
Users
      Read & Execute
        Read
 
Local account added to all files:
AppServiceAcct
      Full Control


Step 4
GPO Location:
Computer Configuration | Windows Settings | Security Settings | Local Policies | User Rights Assignment |Log on as a service
Add the group: Program Services Group
Added the user: AppServiceAcct


Step 5
GPO Location:
Computer Configuration | Preferences | Control Panel Settings | Services
Set the services to log on as AppServiceAcct
      
And this is where I continue to get the warning I put in the beginning. It will not populate and I have run out of ideas..

How would I go about having GPO add an account to all of my computers on the domain and have it set the 3 services that I specify and the SQL instance to log on as this account instead of the SYSTEM account? Any help would be greatly appreciated..
0
Comment
Question by:prologic08
3 Comments
 
LVL 6

Assisted Solution

by:JeffG2583
JeffG2583 earned 250 total points
Comment Utility
It looks like you've got the hard part done by creating the user accounts via GPO. You could always throw something like the below into a batch file and apply it through your GPO... Just a thought.

sc.exe config "Service Name" obj= "User" password= "password"
0
 
LVL 78

Accepted Solution

by:
David Johnson, CD, MVP earned 250 total points
Comment Utility
//use net user to set the password and combine it with the above sc command
net user username password
sc.exe config "Service Name" obj= "User" password= "password"
0
 

Author Closing Comment

by:prologic08
Comment Utility
This allowed me to add the password, thank you. I only worry that the password is in a txt file but I guess this is my only way.
0

Featured Post

Free Trending Threat Insights Every Day

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

Join & Write a Comment

When you upgrade from Windows 8 to 8.1 or to Windows 10 or if you are like me you are on the Insider Program you may find yourself with many 450MB recovery partitions.  With a traditional disk that may not be a problem but with relatively smaller SS…
Citrix XenApp, Internet Explorer 11 set to Enterprise Mode and using central hosted sites.xml file.
Viewers will learn the different options available in the Backstage view in Excel 2013.
The viewer will learn how to simulate a series of sales calls dependent on a single skill level and learn how to simulate a series of sales calls dependent on two skill levels. Simulating Independent Sales Calls: Enter .75 into cell C2 – “skill leve…

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now