Services Account Configuration

What are you trying to accomplish with these? If it is just to run a program on a specific computer then I would add that service account as a local admin to that PC only and leave it as a standard user on the domain. If you are trying to use it to authenticate for LDAP querys then you don't need admin rights to do that so an standard user will work.

Only in an extreme case would I set a service account as an admin anywhere other than a local PC and be sure there is a policy to change that password often.

Any other account just set to never expire, generate a long cryptic password and document it and let it run.

• Use managed service accounts whenever possible
• Deny logon locally
• Set User cannot change password and type password out for vendors (do not give them passwords)
• Set maximum password (128 characters, use copy and paste) and do not reuse passwords
• Never, ever give Domain Admin rights
• Store passwords in vault
• Always assign owner and give full descriptions
• Follow proper naming-standard

Thank you

Manage account mean? Can explain it little more

I am trying to restrict all service accounts from domain rights. only allow them to able to run services... mean third party applications or exchange. SQL and so on.

Best solutions.