Sunday, 18 August 2013

Server 2003 DHCP Server with Low-Access user account

Server 2003 DHCP Server with Low-Access user account

I'm trying to run the DHCP Server service under a low-permissions account
(partly to reduce attack-vectors, and partly just for kicks), as it runs
under LOCAL SYSTEM by default.
I've successfully gotten the DNS Server service running with a low access
account (.\dns), but the DHCP one just isn't working.
I've been using ProcessMonitor to track any ACCESS DENIED events on the
system and/or tcpsvcs.exe, but there are none when I'm starting the
service; yet the SCM reports back that 'Access is denied'.
There is nothing in the Event Log (Application,Security,System) regarding
the cause of failure, and I've already granted the .\dhcp user account the
following permissions:
C:\WINDOWS\system32\dhcp [Full Control + Subfolders]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DHCPServer [Full
Control + Child Keys]
The final operation when the SCM reports back the error is an attempted
WriteFile to \\MACHINENAME*\MAILSLOT\NET\NETLOGON - but running this under
the default system account results in the identical error (bad network
path), so am not sure if this is entirely related.
Does anyone having any tips or suggestions?
OS: Windows Server 2003 R2 Enterprise x86 SP2

No comments:

Post a Comment