Notice: This website is an unofficial Microsoft Knowledge Base (hereinafter KB) archive and is intended to provide a reliable access to deleted content from Microsoft KB. All KB articles are owned by Microsoft Corporation. Read full disclaimer for more details.

LOCAL SERVICE and NETWORK SERVICE accounts cannot be deleted


View products that this article applies to.

Summary

Several customers have been failing a PCI Compliance Auditwhich must be met by direct retailers who use credit-cards as part of their day-to-day business. The audit is set up by credit-card companies as a regulatory function to ensure that their customers comply with the rules; otherwise, those customers are not allowed to process credit-card transactions. See the link above for more information.

One audit requirement for solutions using previous versions of Windows is that all users, except Administrator, be removed from the following Windows policy options. [Computer Configuration > Windows Settings > Security Settings > User Rights Management]: 'Bypass Traverse Checking" and "Replace a Process Level Token".

However, when this is done for the systems in the Applies To list, the settings are automatically repopulated with Administrator, LOCAL SERVICE, and NETWORK SERVICE, resulting in audit failure.

↑ Back to the top


More Information

The behavior observed is "by design". Beginning with Windows Vista and Windows Server 2008, Microsoft has introduced the notion of required privileges for services. Without this set of privileges, certain critical operating system services would be unable to start and the machine would be rendered unusable.

↑ Back to the top


Keywords: kb

↑ Back to the top

Article Info
Article ID : 2744884
Revision : 1
Created on : 1/7/2017
Published on : 8/15/2012
Exists online : False
Views : 417