Triggered by an offline question about whether "act as part of the operarting system" is really needed on Windows ( https://httpd.apache.org/docs/2.4/platform/windows.html), our friend Claude concludes:
Short answer: nothing in httpd has ever needed it. The recommendation is a documentation fossil that started as a copied Microsoft troubleshooting checklist and was later rewritten into a positive instruction. How the text got there - June 2000, r85484. William Rowe committed Andrew Braund's review of the Win32 docs. In win_service.html it added a section titled "If you encounter error 2186 when trying to start Apache, the following workaround may help", with NT4 User Manager steps ending in "verify that the following rights have been granted to the service account: Act as part of the operating system, Back up files and directories, Log on as a service, Restore files and directories". That four-right list is generic NT4-era Microsoft service-account boilerplate, not anything derived from httpd. The 1.3 branch docs carry the identical text. - December 2002, r97932. Iikka Meriläinen's rewrite merged win_service.xml into windows.xml. The troubleshooting checklist was turned into step 2 of "create a separate account for httpd": "Grant the newly-created user a privilege of Log on as a service and Act as part of the operating system". Backup and Restore were dropped, but Act as part of the OS survived. That is the moment a "check these if you see error 2186" workaround became a standing recommendation. The current docs/manual/platform/windows.xml:313 is still that 2002 wording, and the error 2186 note nearby now says only that it indicates a network-resource problem. What the code actually does - The 1.3 os/win32/service.c, the 2.0-era service.c, and today's mpm_winnt never call LogonUser, ImpersonateLoggedOnUser, CreateProcessAsUser or AdjustTokenPrivileges. The MPM just calls ap_sys_privileges_handlers and carries a comment that it "presumes proper privileges". - The only LogonUser in the tree is in APR's win32 proc.c behind apr_procattr_user_set, whose sole httpd caller is the mod_rewrite prg map user option. On NT4 LogonUser did require SeTcbPrivilege, which is the one plausible technical reason products of that era told admins to grant it. Windows 2000 removed that requirement, and httpd doesn't exercise that path on Windows in normal use anyway. Conclusion: the only right the service account needs is "Log on as a service", plus the filesystem ACLs the docs already list. "Act as part of the operating system" is one of the most powerful rights on the box and the docs should stop recommending it. Sources: Q155814: Error 2186 (Exchange), Troubleshoot service startup permissions, Event ID 7041, StarTeam note on error 2186 -/- Anyone recall/know otherwise or can think of features that would expose a problem without it? -- Eric Covener [email protected]
