Can the Performance Sentry Collection Service impersonate a User Account to gain access to secure network resources?
Date: October 7th, 2009 | Category: NTSMF - Collection Service
http://faq.demandtech.com/2009/10/07/2-12-can-the-performance-sentry-collection-service-impersonate-a-user-account-to-gain-access-to-secure-network-resources/
Yes.
By design, the Performance Sentry Collection Service (dmperfss.exe) is installed to run under the built-in LocalSystem (SYSTEM) account. This built-in account, which most services use, has the authority to perform almost any internal function on the local machine. However, the LocalSystem account has no built-in facilities to access secure network resources, such as shared network folders.
The Performance Sentry Collection Service performs two sets of functions where security considerations may apply:
There are two ways to authorize the collection service to perform these secure functions:
Impersonation allows the collection service to adopt temporarily a different security identifier (SID) than the the one specified when the service is started. You assign the User Account and Password that the collection service will impersonate when you install the collection service. The User Account you assign will be used whenever the collection services performs any function that might need to done under a security context other than LocalSystem (or SYSTEM). If you assign a User Account and Password during installation of the collection service, the collection service will impersonate that User Account when it launches the Cycle End command. This allows the Cycle End command or script to execute under a User Account that is authorized to perform network file operations on a secure shared folder. In addition, if the NTSMF \data\ Folder is protected from uncontrolled access by the LocalSystem account, you may need to assign Performance Sentry a User Account to impersonate when it performs any function that accesses the \data\ Folder.
You assign the User Account to be impersonated during the Performance Sentry Collection Service installation using the -account and -password options, as illustrated below:
dmperfss -install -f MyDCS.dcs -account DomainName\myAccount -password xxxxxxx
You may also assign the User Account by using the automation interface command dmcmd.exe found in the root NTSMF folder:
dmcmd.exe -account DomainName\myAccount -password xxxxxxx
For more details, see Chapter 2 of the User’s Manual.
Article published on The Demand Technology FAQ - http://faq.demandtech.com