Can't change certsvc to log on using user account

[David Beaven]

In order to publish crls to a remote server I want to have certsvc log on as
a user and lock down the remote file location with acls for that user.
I created a new admin user and told the service to log on as that user
(logon as service right given)
Error: could not start the certificate services service on the local
computer. Error 1314: A required privilege is not held by the client.
I have tried adding most privileges under local policy for User rights
assignments but no improvement (and isn't defined in a gpo).
Thanks
David

 

[David Beaven]

Looks like I can allow Cert Publishers Group access to the resource and
leave certsvc running on the system account
http://www.microsoft.com/technet/security/guidance/secmod183.mspx

 

[Feng Mao]

Hi David,

I am glad that you have found the solution and share the information with
us.

Have a great day!

Thanks & Regards,

Feng Mao [MSFT], MCSE
Microsoft Online Partner Support

Get Secure! - www.microsoft.com/security

=====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.



--------------------
| From: "David Beaven" <[email protected]>
| References: <#[email protected]>
| Subject: Re: Can't change certsvc to log on using user account
| Date: Fri, 23 Jul 2004 20:14:47 +0100
| Lines: 22
| X-Priority: 3
| X-MSMail-Priority: Normal
| X-Newsreader: Microsoft Outlook Express 6.00.2800.1437
| X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1441
| Message-ID: <eQ#[email protected]>
| Newsgroups: microsoft.public.win2000.general
| NNTP-Posting-Host: spr2-brig5-3-0-cust217.lond.broadband.ntl.com
81.105.59.217
| Path: cpmsftngxa06.phx.gbl!TK2MSFTNGP08.phx.gbl!tk2msftngp13.phx.gbl
| Xref: cpmsftngxa06.phx.gbl microsoft.public.win2000.general:148964
| X-Tomcat-NG: microsoft.public.win2000.general
|
| Looks like I can allow Cert Publishers Group access to the resource and
| leave certsvc running on the system account
| http://www.microsoft.com/technet/security/guidance/secmod183.mspx
|
|
| | > In order to publish crls to a remote server I want to have certsvc log
on
| as
| > a user and lock down the remote file location with acls for that user.
| > I created a new admin user and told the service to log on as that user
| > (logon as service right given)
| > Error: could not start the certificate services service on the local
| > computer. Error 1314: A required privilege is not held by the client.
| > I have tried adding most privileges under local policy for User rights
| > assignments but no improvement (and isn't defined in a gpo).
| > Thanks
| > David
| >
| >
|
|
|