Question about security best practice.
Several best practices articles recommend removing Builtin/
administrator from the sysadmin group. One side affect is that
several third party utilities will try to log in as "nt authority
\system". E.g. fulltext will attempt nt authority\syste m -- however
fulltext can be configured to use a domain account. Our commvault
tape backup attempts to do "live backups" using nt authority\syste m.
Googling suggests that various viruses have attempted to exploit nt
authority\syste m. A government cookbook says you can logon as
localsystem by using the ATScheduler.
Given all this -- I leaning towards recommending that Nt Authority
\system should only be given data-reader rights, if any rights at
all. Please let me know what you think.
- Louis
