Run the Windows service as a non-SYSTEM account

[rgl]

Unless I'm missing something, the DnsService Windows Services does not need to run as the SYSTEM account, as such, it should run as NT SERVICE\DnsService.

These types of accounts are automatically managed by Windows and do not need a password.

They also have a predictable SID in the form of S-1-5-80-<SHA-1(uppercase(service name))> (e.g. S-1-5-80-908493856-1104173099-1205760238-637266923-2292294691).

The gist to configure a Windows service to use then is:

sc.exe sidtype $serviceName unrestricted
sc.exe config $serviceName obj= "NT SERVICE\$serviceName"

The full example is at:

• https://github.com/rgl/dummy-windows-service
• https://github.com/rgl/dummy-windows-service/blob/master/run.ps1

[ShreyasZare]

Thanks for the suggestion. I tried it and the issue with it is that the service does not have privilege to create the C:\Program Files (x86)\Technitium\DNS Server\config folder thus it fails to start. Need to find a way to fix this to be able to use this.

[rgl]

That is normally done by the setup application, while executing as Administrator/SYSTEM. The setup application should create the directories with the appropriate permissions (e.g. prevent ACL propagation/inheritance from the parent directory, and grant Full Permission to SYSTEM, Administrators, and NT SERVICE\DnsService).

PS Probably the application should also be modified to write somewhere inside C:\ProgramData (e.g. C:\ProgramData\Technitium\DnsServer). If possible, C:\Program Files should be treated as read-only.

[pricerc]

Thanks for the suggestion. I tried it and the issue with it is that the service does not have privilege to create the C:\Program Files (x86)\Technitium\DNS Server\config folder thus it fails to start. Need to find a way to fix this to be able to use this.

As mentioned by @rgl, data should not be stored in "Program Files", it should be in "C:\ProgramData". Or in "%systemroot%\System32\config\systemprofile" (typically "C:\WINDOWS\system32\config\systemprofile").

You would still need to create the ProgramData folder in your setup script.

edit to add: "C:\Program Files" on Windows is like "/usr/bin" on unix/linux - you don't put data in there.