Article Information

• Type: INFO
• ID: 1003
• Created: 2004-10-18 at 09:00:00-05:00

Applies To

• Product: PPW (PlanetPress Watch)
• Applies To:

INFO-1003: Local System Account Limitations

Description

What are the limitations of running services under the Local System account ?

Contents

Windows NT services (as well as XP, 2000, 2003, etc.) run as Local System by default. Local System is a predefined local account which has the following characteristics:

• The account cannot open the HKEY_CURRENT_USER registry key.
• The service can open the HKEY_LOCAL_MACHINE\SECURITY registry key.
• The service has no network credentials and can only access network resources using a null session.

If a share or pipe is accessible by Guest via a null session, it has access. There is a common misconception that a service running as Local System has no network access. In other words, if a network location is available to "Everyone", even without a username and password, then the Local System account will have access to it.

If you use a user account for the service rather than a local system account, however, be warned that Windows NT does not allow the service or any launched application to interact with the desktop. This means you will not see messages, pop-ups or launched applications.

Whenever the PlanetPress Watch service uses a user account, you may set the process to Run on Desktop. The thread (process) will then be associated with the desktop, so if a user is logged into the machine (i.e. if the desktop is active), all executables called by the process will run on this desktop and any output will be displayed to the user.