Re: Threat vector of running a service using a domain account

["Ali, Saqib" <docbook.xml () gmail com>]

Scott,

Thanks for the response.

> AD will allow you to mitigate the risk by specifying that the account
> can only login to the appropriate server(s).  I assume you knew that,
> but it wasn't mentioned, so I'll throw it out there.

Actually client are target of this particular service not servers. The
reasons it puts itself in the Domain Admin group is that it needs
administrative access to the client computers. And since Domain Admin
group is part of the Local Administrator group on all client computers
it works out nicely.

Is there way to specify that the account can only login to client
computers and not servers?

Our last resort was to add the account to Local Administrators group
using GPOs as you mentioned.

saqib
http://security-basics.blogspot.com/