Local service accounts and network shares

[Bas Hamer]

ok, so I kow that the local system accoutn can't get to a network share, and
if you want to do that and not lose any of your other priveliges you need to
run under a user name and password that is configured at installation.

So now for the problem.

How do I get around this ?

I really would liek to be able to reduce the amount of steps that the user
has to take to deploy my aplication, and I really don't want to send the user
in to modify local account policies. Also it creates a lot of hell for tech
support each time a user changes their password and the services all decide
to die due to privelige issues.

How do you clean this issue up ?

any hints/commnets/sugestions will be greatly appreciated.

[Glen]

Hi Bas,

You're talking about network resource security vs. user friendly, and
the two are often disparate (at least in a well secured network
environment). The best way I've found to work in a disconnected
environment is to test the network resource, trap any errors, and prompt
the user for a username/password. I then store the information they
provide in an encrypted resource file in their local account folder
(C:\Documents and Settings\[UserName]\Application Data\[MyApp]).

The stored information in the encrypted file can be used so that the
user only gets prompted once when a particular resource account login
changes. However, you must be considerate of security policies and
issues at any given location if using this type of approach.

Hope this helps.

- Glen

Bas Hamer wrote:

ok, so I kow that the local system accoutn can't get to a network share, and
if you want to do that and not lose any of your other priveliges you need to
run under a user name and password that is configured at installation.

So now for the problem.

How do I get around this ?

I really would liek to be able to reduce the amount of steps that the user
has to take to deploy my aplication, and I really don't want to send the user
in to modify local account policies. Also it creates a lot of hell for tech
support each time a user changes their password and the services all decide
to die due to privelige issues.

How do you clean this issue up ?

any hints/commnets/sugestions will be greatly appreciated.

[Willy Denoyette [MVP]]

The "LocalSyste m" account uses the machine account to access network
resources, if you run in a AD domain realm (were all machine accounts are
considered normal user accounts) you simply have to grant this account the
required access rights to the resource.
If this is not possible, you could call NetUseAdd through PInvoke in order
to establish a use record (specifying the user credentials with appropriate
privileges) .

Willy.

"Bas Hamer" <Ba******@discu ssions.microsof t.com> wrote in message
news:E2******** *************** ***********@mic rosoft.com...

ok, so I kow that the local system accoutn can't get to a network share,
and
if you want to do that and not lose any of your other priveliges you need
to
run under a user name and password that is configured at installation.

So now for the problem.

How do I get around this ?

I really would liek to be able to reduce the amount of steps that the user
has to take to deploy my aplication, and I really don't want to send the
user
in to modify local account policies. Also it creates a lot of hell for
tech
support each time a user changes their password and the services all
decide
to die due to privelige issues.

How do you clean this issue up ?

any hints/commnets/sugestions will be greatly appreciated.