Geo SCADA Service User Account

[sbeadle1]

📖 Home  Back  

Running DBServer as a LocalSystem User

By default the Geo SCADA installer will configure the *DBServer* process to be run as the *LocalSystem* user. 

Running as the *LocalSystem* user is required by Microsoft so that the server can call the LoadUserProfile method, which is used by the user impersonation feature. User impersonation is used by:
- The System call database object
- Printing (server side), used by the Crystal Reports Driver
- The Backup object
- File Upload drivers (Technolog, Primayer, XML - these drivers are not usually available)
- The Crystal Report driver (specifically for MAPI email & exporting of report files)
- The SQL export driver

Alternatively the process can be run as a user account which is a member of the local *Administrators* group or as a virtual service account (VSA). However, if you wish to run DBServer under an alternative account, the above list of features will not be available.

Requirements of the Account Running DBServer

The following requirements also need to be met by the account running DBServer:

DBServer requires full control over the following registry keys and sub-keys (plus keys for any additional database servers):
- HKEY_LOCAL_MACHINE\SOFTWARE\Schneider Electric\ClearSCADA
- HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Schneider Electric\ClearSCADA

DBServer reads/writes the *WaitToKillServiceTimeout* value in the following registry key:
- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control

Members of the *Administrators* group have full control of these registry keys.

DBServer requires the following user rights:
- Adjust memory quotas for a process - "SeIncreaseQuotaPrivilege" - Required to execute system commands.
- Replace a process level token - "SeAssignPrimaryTokenPrivilege" - Required to execute system commands.
- Back up files and directories - "SeBackupPrivilege" - Required to load another user's profile (to bypass NTFS permissions).
- Restore files and directories - "SeRestorePrivilege" - Required to load another user's profile (to bypass NTFS permissions)..
- Log on as a service - "SeServiceLogonRight" - Required as DBServer runs as a service.

Using a Virtual Service Account

It is recommended for additional security that you consider using a virtual account for the Geo SCADA service. However, doing so will prevent a server from using the user impersonation features specifically listed above. Other features are not affected.

In order for services to logon using a virtual account the "NT SERVICE\ALL SERVICES" group should be assigned the "Log on as a service" user right. Manually configuring any service (using "Services.msc") to logon using a virtual account will automatically do this.

To use the Geo SCADA server with a virtual account, use the 

/virtualaccount

 command line switch to DBServer to allow service to be created running under a virtual account, including the security settings listed below:

DBServer.exe /service /virtualaccount

The 

/noservice

 command line switch will remove all of the security settings if running under a virtual account:

DBServer.exe /noservice

You do not need to do this before uninstallation of Geo SCADA or an upgrade.

Note that if you use an alternative account such as a Virtual Service Account, it is reset back to LocalSystem on upgrade/repair by the installer. Therefore you must use the /service /virtualaccount switches again after an upgrade or repair.

The /virtualaccount switch will:
- Set permissions on 

HKLM\SOFTWARE\Schneider Electric\ClearSCADA

 registry key (and sub-keys) to give VSA full control.
- Set permissions on 

HKLM\SOFTWARE\WOW6432Node\Schneider Electric\ClearSCADA

 registry key (and sub-keys) to give VSA full control.
- Assigns the following user rights to the VSA:
-* Adjust memory quotas for a process
-* Back up files and directories
-* Replace a process level token
-* Restore files and directories

You need also to add an additional 120 seconds (above 5 second default) manually to the registry key 

HKLM\SYSTEM\CurrentControlSet\Control\WaitToKillServiceTimeout

. The value is in milliseconds. This is normally done during DBServer startup, but under VSA it doesn't have permission to modify this registry setting and so will log a failure and continue.

Go: Home Back