How to Configure a Least-Privilege Account to Host Your Service

- J.D. Meier, Carlos Farre, Jason Taylor, Prashant Bansode, Steve Gregersen, Madhu Sundararajan, Rob Boucher

Use a least-privilege account to host your service in order to reduce your application’s overall attack surface and reduce the potential impact of security vulnerability in your service. Using a least-privilege account, allows you to audit and authorize your service individually, and your service is protected from changes made to the privileges and permissions within the default account.

Use the following steps to create a least privileged account to host your service:
  1. Create a Windows account
  2. Run the following aspnet_regiis.exe command to assign the relevant ASP.NET permissions to the account:
aspnet_regiis.exe -ga machineName\userName

Note: This step is needed If your application needs to run in ASP.NET compatibility mode, else you can skip the step.
  1. Use the Local Security Policy tool to grant the Windows account the Deny logon locally user right. This reduces the privileges of the account and prevents anyone logging onto Windows locally with this account.
  2. Use the least privileged account to run your WCF service:
    • If your service is hosted in IIS 6.0, use IIS Manager to create an application pool running as an account identity. Use IIS Manager to assign your WCF Service to that application pool.
    • If your service is hosted in Windows Service, configure the Windows Service to run using the account identity, the WCF service will run under the security context of the Windows Service.

Additional Resources

Last edited Jun 13, 2008 at 7:03 PM by prashantbansode, version 1

Comments

No comments yet.