Microsoft Windows NT 4.0 Guide Manual de usuario descargar pdf (Pagina 89)

Microsoft

Windows Server

™

2003 White Paper

Windows NT 4.0 Server Upgrade Guide 84

Figure 36. Standard view of the Services snap-in

Service Security Contexts

Windows NT Server 4.0 and Windows 2000 support a single, built-in account used for various

services. All services in Windows NT Server 4.0 and Windows 2000 use either the LocalSystem

account or a user-defined account typically referred to as a service account. Most user-defined

service accounts created for various applications in Windows NT Server 4.0 are created with a

high level of permissions, such as a domain administrator.

A common problem with service accounts is how to maintain a password that is as secure as

possible for these accounts. Most Windows NT 4.0 administrators set the password never expires

flag for service accounts to ensure that these accounts do not automatically stop working when

the password expires sometime in the future. This common practice creates a large security hole

in many Windows NT 4.0 domains. Most service accounts in Windows NT 4.0 had elevated

permissions with passwords that rarely changed.

Unfortunately for some applications, such as Exchange Server 5.5, there is no alternative to using

a separate, user-defined service account. Because of the authentication complexities across

Windows NT 4.0 domains using Exchange 5.5 services, a user-defined service account was

required. Windows 2000 and Active Directory provided the ability to use the LocalSystem account,

rather than a user-defined service account for some applications. Exchange 2000 was designed

to take advantage of this fundamental change in the LocalSystem account.

Windows Server 2003 takes the LocalSystem security context one step further. Two new built-in

accounts offer lower privileges for running services. Now, instead of one built-in account, three

built-in accounts offer various security contexts. The security context restricts the service to

accessing the resources accessible to the specified account. The three built-in service accounts

are:

1 2 ... 84 85 86 87 88 89 90 91 92 93 94 ... 154 155

Sin comentarios

Microsoft Windows NT 4.0 Guide Manual de usuario Pagina 89