user "logon as a service" right. Any dangers?

[link626]

granting a regular User 'logon as a service' right....... are there any dangers I should be aware of?

They don't have escalated privilege, right? They are still restricted to whatever regular Users group can do?

 

[GokAy]

Check this out windows server 2003 - Exact extent / meaning of "Log on as a service" permission (W2K, W2K3)? - Server Fault

When logged in as the service account, run in cmd:

whoamI /all |clip

Clip will copy the results to the clipboard so you can paste to a notepad, easier to read as cmd window wraps the lines.

Also mentioned is Process Explorer of the SysInternals suite.

 

[Alejandro85]

The only thing that "logon as a service" does is allowing any service to use that user account to run the process. The user itself and all his processes (both interactive and those that run with a service) are still subject to the same permission restrictions as always and can do no more or less than before.

Normally there is little reason to give this permission to anyone, unless you want to add some services and fine-tune their access rights. The services control panel also grants this to any user that you put as the login for a service. I won't consider this "harmful" but certainly don't grant it unless needed.