Local Service NT AUTHORITY\LOCAL SERVICE Local and Network (network access uses anonymous credentials) Low (as authenticated user) Network Service NT AUTHORITY\NETWORK SERVICE Network (uses computer account credentials) Low (as authenticated user) Local System NT AUTHORITY\SYSTEM Local and Network (network access uses computer account credentials)

Some additional facts should be pointed out concerning the account identities.

You do not have to manage their passwords - Because these built-in identities are created by Windows itself, the operating system manages their account passwords. In this respect these accounts function like managed service accounts and virtual accounts.

The Local System account is very highly privileged - The Local System identity is granted system privileges that make this account in many ways more powerful than the built-in Administrator account. Although Local System was designed for access on a local computer only, this account can be associated with services that move across your network. In this case, the credential that is presented to remote processes is <DomainName>\<ComputerName>$.

The Local System account cannot be used to run PcVue .

Be wary of Local Service and Network Service account group membership - Again, the “Local” and “Network” parts of these account names inform us that the Local Service and Network Service accounts are targeted at local and network use, respectively.

However, you should always keep in mind that the Local Service account runs locally as a member of the computer’s Local Users group (Domain Users on domain controllers) and runs remotely as an anonymous connection.

By contrast, the Network Service account runs locally as a member of the local Users or Domain Users groups, and runs remotely as a member of the Authenticated Users group. In addition, Network Service inherits any permissions that have been granted to the source computer account in Active Directory.

The fact that Local Service runs remotely as an anonymous connection means that any attempt to use Windows hosted network resources will probably fail. However, it does not mean a TCP/IP connection to a PLC would fail, as it does not normally require a Windows authentication.

In order to apply the principle of minimal privilege, the Local Service account is used in PcVue default configuration.