You are so right on the money with that, it’s not funny!!

Thanks!

Jim (JR)

1. Remote Desktop into WHS as Administrator.
2. Start > Run > gpedit.msc. This opens Group Policy Editor.
3. Expand Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment.
4. Open Allow log on through Terminal Services.
5. Click Add User or Group.
6. Click Object Types and ensure Groups is checked. Then enter Remote Desktop Users as the object name and click Check Names. The name should be found.
7. Click OK until exited.

HOWEVER, giving the user account admin rights to install the program and making sure the program writes files to a place where any normal user can write to, and then taking away admin rights from the user… now that should work out just fine… If the process starts acting up, it will be acting up as a regular user, not as admin.

Creating a new user account is useful for the following reasons.

First and foremost you have a profile that has a very lightweight registry entry. That is, if you don’t keep messing about with the account. The idea is that with a service account all you do is to run services, so your Application Data should be very light and so would be this account registry.

I do think, however, that is unnecessary to create one account for each service in the case of WHS.

Another thing is that this account could have different security policies. For example you could enforce a more severe lockdown for this account, or prevent users from using terminal services with it, etc.

Adding the new user account to the “Administrators group” provides the user with just as much privledge (attack surface) as using the Administrator account.