Confuses LocalSystem and LocalService Accounts

Question

I am new to programming Windows services. I have a confusion about how to set the type of account when writing Windows services.

How to choose or how to determine what type of account you need to set when writing a service?

Answer 1

Usually we create special windows (local for local access or domain accounts for operations requiring authentication through the network) to launch user services. This way we can restrict and block permissions to make sure that he has access only to what we need. You can also see which specific users are the culprits or resources hanging with monitoring on a shared server.

Regarding built-in accounts ...

Local system: Built-in user account LocalSystem has a high level of access rights; he is a member of the Administrators group.

: , LocalSystem, .

: , , . , , . (): Microsoft Technet

Answer 2

LocalSystem , . , LookupAccountName.

. NT AUTHORITY\SYSTEM BUILTIN\Administrators; . -.\LocalSystem. , LocalSystem ComputerName\LocalSystem. . LocalSystem CreateService ChangeServiceConfig, , , .

NetworkService

NetworkService , . , LookupAccountName. .

CreateService ChangeServiceConfig. , , , , . , SCM . , LookupAccountSid, NT AUTHORITY\NetworkService CreateService ChangeServiceConfig, .

, NetworkService, . SID Everyone Authenticated Users. SID SECURITY_NETWORK_SERVICE_RID.

NetworkService HKEY_USERS. HKEY_CURRENT_USER NetworkService.