If you do not require network credentials, use a local account. If you require network credentials, use a domain account. Instead, create a custom account, and then grant the account the user rights that your service may require. If you require more user rights than those that are granted to the minimal user accounts, do not run the service as a user with administrative credentials.Īlso, do not change the security policy to elevate the user rights of the built-in logons (SYSTEM, Anonymous Logon, Local Service, and Network Service). To help secure your system from attacks, run the service with minimal user rights.
Run the service in a specific security context. Therefore, remove all the Assert statements before you ship your service. The Assert method displays a dialog box that shows the line of code that failed, and then gives you the option to debug the code. Microsoft does not recommend that you use the Assert method. Remove all Assert statements before you ship your service. This elevation of privilege attack may be carried out either by a user who has physical access to the computer or by a user who logs on the computer by using Microsoft Terminal Services. If the interactive user sends a WM_COPYDATA message, copies malicious code into the address space of a highly privileged interactive service process, and then sends a WM_TIMER message, the service process runs the malicious code. The interactive user may inject and run the arbitrary code in an interactive services process. When the interactive user is logged into the same instance of Windows Services, window message attacks may occur.
Run the service as an isolated service without user intervention. Design your service to run without any user intervention.ĭo not build interactive services. These applications typically perform tasks in the background. Service applications run outside any particular user context and should not require any user intervention. The following guidelines may be useful when you write a Windows Service:ĭesign your service for use without a user interface.
Windows Services are automatically started when you start the computer and do not have a user interface. Examples of Windows Services include server products, such as Microsoft Exchange and Microsoft SQL Server, and other client applications, such as Windows Timer that sets the computer clock. A Windows Service is a program, a routine, or a process that performs a specific system function to support other programs, particularly at a low (close to the hardware) level. The article also suggests best practices to follow when you create Microsoft Windows Services. This article describes some common mistakes that you must avoid when you write a service. Descriptions of some best practices when you create Windows Services Summary
0 kommentar(er)
