Task Sequence Run As Account Security Issues - What are the risks?

Question

Hi there.

According to this article, why should I NOT use the network access account, make the account a domain administrator, or configure roaming profiles for this account? If it’s a security issue, I would understand, but can somebody please explain in detail the following security precautions:

1. Don’t use the network access account for this account.
2. Don’t make the account a domain administrator.
3. Don’t configure roaming profiles for this account.

I really appreciate a fast response. Thanks!

Answer 1

Hi,

==>1,Don't use the network access account for this account.

Generally speaking, the network access account is only used to access the associated resources on the network and not require local permissions, but task sequence run as account may require administrative access on the computer sometimes. These two accounts are different purposes.

2,==>Don't make the account a domain administrator.

For security reasons. And there is no need to do this. If it requires administrative access on the computer, consider creating a local administrator account solely for this account rather than a domain administrator account.

==>3,Don't configure roaming profiles for this account.
As the document says: "When the task sequence runs, it downloads the roaming profile for the account. This leaves the profile vulnerable to access on the local computer."

Best regards,
Simon

---

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.