Least Privilege Service Account for Network Folders

Last updated
Save as PDF

Article # 3016346 - Page views: 804

In order to write to a network folder, Autostore must run under a service account as opposed to the Local System account.ﾠ This service account needs to be given proper permissions.ﾠ This article explains how to do that.It is recommended to follow the least privilege principle.ﾠ Least privilegeﾠmeans theﾠservice account shallﾠbe granted only theﾠminimum permissionsﾠto get the job done, but nothing more.ﾠThe service accountﾠshall be permitted toﾠwrite a file or create a sub folder, but not deleteﾠa file.ﾠ Additionally, it is recommend (but not required), to permit the service account to read folder contents, becauseﾠwithout seeing the folder it would be impossible toﾠtest or troubleshoot theﾠpermissions.ﾠ However, the service account shall not be permitted to read any files.ﾠ (which is accomplished by disabling "Read extended attributes")

Steps and Instructions

Step 1 - Set Access Control List (ACL)

Create a service account
Go to the network folder you want to access
Add the service account and apply the permissions exactly as shown in the picture below, allowing
- List folder / read data
- Read attributes
- Create files / write data
- Create foldersﾠ/ append data
- Write attributes
- Write extended attributeﾠﾠﾠ
Make sure that those permissions are inherited by all it's subfolders and files
If the network folder is large, then applying those permissions might take a while becauseﾠpermissionsﾠare individually assigned to allﾠit's child objects.

Step 2 - Set Network Share

Network folders are shared usingﾠshares
Set the correct permissions for the share as well
Your service account needs
- Change, and
- Read

ﾠ

Step 3 - Promote service account to local Administrator

Important:ﾠ You must add the service account to the administrators group on the local Autostore server.ﾠ (Do notﾠmake itﾠdomain administrator)

ﾠStep 4 - Test correct permissions

As a least privilege user account,ﾠthe Autostore service accountﾠshall beﾠallowed to write files and list folder contents, but itﾠshall notﾠhave permission to read a file or delete a file
You need to test this and make sure it works properly
Logon to the Autostore server as the service account
Click Start/Run
Enter your network folder
You should see your network folder
You will see the files in this network folder
Try to copy any file into this folder - This should work, because the service account has write permission
Try to open any file -ﾠThe expected behavior isﾠpermission denied, becauseﾠthe service account doesn't haveﾠ"read extended attributes permission"