Applies to: Windows Server 2019, Windows Server 2022, and Windows Server 2025.
This guide creates a non-interactive local service identity and assigns only the logon right required by a server application.
Prerequisites
- An approved account name and password policy.
- Administrative access to the application server.
- The application vendor confirms support for a dedicated service identity.
Configuration procedure
- Create the local account with a long managed password.
- Remove unnecessary group memberships and deny interactive sign-in through policy.
- Grant Log on as a service through a controlled Group Policy Object or Local Security Policy.
- Configure the application service to use the new identity.
- Restart during a maintenance window and review the Service Control Manager log.
PowerShell commands
$password = Read-Host "Service account password" -AsSecureString
New-LocalUser -Name "svc_app01" -Password $password -PasswordNeverExpires:$false -UserMayNotChangePassword
Get-LocalUser -Name "svc_app01"
Verification
The service starts under the intended account, the application health check succeeds, and no logon failures appear in the Security log.
Rollback
Reassign the service to its previous identity, restart it, remove the newly granted user right, and delete the account only after confirming no scheduled task or component uses it.
Security and operations
- Prefer a group managed service account for domain workloads that support it.
- Never add a service identity to Administrators unless the vendor explicitly requires and documents it.
- Store credentials in an approved secrets system.
Related resources
Build your Canadian Windows VPS environment with networkmanager.info. Consult the Microsoft Windows Server documentation before production deployment.
