Regarding NT Authority\Networkservice account

Question

Hello All,

In our organization we have a strict policy of users accessing any servers via a AD group which is added under the specific server's local admin group and the user accounts added under the AD group. Any accounts which are added directly under the local admin group(except a few whitelisted ones) throws an alert ticket for the support team.

Last day, we got an alert that the system account 'NT Authority\NetworkService' was added under the local admin group of the server. When we verified with the users they are completely unaware of the scenario. After an hour or two the account automatically disappeared from the group. We tried to check the logs if someone has manually added the account to the group but could not find any details.

Please help me to understand how these local system accounts work. Also if these system accounts can get added to the admin group automatically via any services for the purpose of some task and auto removed once it is done?

Thanks a lot in advance.

Answer 1

Read on here.
https://learn.microsoft.com/en-us/windows/win32/services/networkservice-account
https://learn.microsoft.com/en-us/windows/win32/services/service-security-and-access-rights#access-rights-for-a-service

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 2

Thanks for the details. understood the basic working, however still confused how the account got automatically added and then auto removed from the local admin group.

Thanks