How to disable SeImpersonate Privilege for a user having local Service rights ?

Ravi Kumar 1 Reputation point
2022-11-14T09:14:53.337+00:00

Currently i am using Apache Tomcat under Local user (say as TestUser) created from edit local user and groups.
But when i log on using TestUser to Apache Tomcat Service, it automcaticallly assigns Local service rights to TestUser, which also enables SeImpersonatePrivilege for TomcatService.

I need to log On Apache Tomcat with any user with least privileges in which SeImpersonatePrivilege need to disabled.

Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
12,567 questions
Windows Server Security
Windows Server Security
Windows Server: A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.Security: The precautions taken to guard against crime, attack, sabotage, espionage, or another threat.
1,776 questions
0 comments No comments
{count} votes

3 answers

Sort by: Most helpful
  1. Wesley Li-MSFT 4,401 Reputation points Microsoft Vendor
    2022-11-15T08:30:20.557+00:00

    Hello

    SeImpersonatePrivilege is a Windows security setting that is assigned by default to the device's local Administrators group and the Local Service account.
    The role is to determine which programs are allowed to impersonate a user or other specified account and perform actions on behalf of the user.

    If you need to disable SeImpersonatePrivilege, try the following steps:

    1. Click Start, point to Programs, point to Administrative Tools, and then click Local Security Policy.
    2. Expand Local Policies, and then click User Rights Assignment.
    3. In the right pane, double-click Impersonate a client after authentication.
    4. In the Local Security Policy Setting dialog box, click Delete.
    5. In the Select Users or Group dialog box,click the user account that you want to delete,click Delelte, and then click OK.
    6. Click OK

    For more information, please refer to the following documents:
    https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/seImpersonateprivilege-secreateglobalprivilege

    Best Regards,
    Wesley Li

    1 person found this answer helpful.
    0 comments No comments

  2. Wesley Li-MSFT 4,401 Reputation points Microsoft Vendor
    2022-11-18T02:22:34.23+00:00

    Do you have any other questions?

    If the above reply is helpful to you, please mark it as answer.

    Thanks

    0 comments No comments

  3. Wesley Li-MSFT 4,401 Reputation points Microsoft Vendor
    2022-11-25T03:02:55.233+00:00

    Hello

    Do you have any further questions?

    How is the issue progressing so far?

    Thanks

    0 comments No comments