Changing the Log on Account for NI Services Running With Service Accounts

Issue Details

There are several NI services that are running with service accounts that were set up during the LabVIEW installation. These are services where the "Log On As" field is something other than Local System, Local Service, or an authorized account on our domain. These are some of the services and the corresponding user name: NI LXI Discover Service (niLXIDiscovery), NI PSP Service Locator (lkClassAds), NI Route Coordinator (niroco), NI-RIO Server (nirioserver), NI-RIO Server Legacy (NiRioRpcLegacy), NI-XNET IP Stack Service (nixntipstackd), etc. Is there any recommendation from NI on how to set up these types of service accounts?

Solution

NI Services that run as "Virtual Service Account" are following current NI security recommendations. This account type has the least privileges compared with other service account options and is recommended for services that do not need access to system or network resources. So with that understanding, setting the services to "Local System Account" would grant them more privileges than the service needs and it does not negatively affect the functionality of the services.

If you plan to change the user, then you should consider the following guidance from Microsoft: 
Assign the "Log on as a service" user right to NT SERVICE\ALL SERVICES in the Group Policy Object (GPO) that defines the user right. You can read more about Microsoft's guidance on this issue with a SQL service in the following external link: Error when you install WID in Windows Server 2012.