Task: Start the hub service as the local system (Windows only)

• Overview
• Part 1: Give SYSTEM full control of hub directory
• Part 2: Set the hub service to start as SYSTEM
• Links

Overview

On Windows systems, by default, the CodeSonar hub runs as a service "owned" by the user who originally created the hub.

In some cases you may prefer that the service belongs to the local system acount (SYSTEM) rather than a particular user. In particular, the local system account does not need to run with a given username and password. This means that if the hub creator leaves the company, or their password changes, no changes to the hub are required. It also means that the hub can be administered by anyone with administrator rights on the system.

Note that there are also downsides to this approach.

• SYSTEM has strong privileges. Running as SYSTEM goes against the Principle of Least Privilege.
• It will be less obvious which human user is responsible for the hub.
• You will typically need to switch to the SYSTEM account in order to perform operations on the files in the hub directory.

This page provides instructions for switching ownership of the CodeSonar hub service to the SYSTEM account. There are two main parts to this process.

• Part 1: Give the SYSTEM account control over the hub directory.
• Part 2: Set the hub service to start as the SYSTEM account.

Part 1: Give the SYSTEM account full permissions on the hub directory

In order to run the hub service, the SYSTEM account will need full permissions on the hub directory. To make sure it has these permissions, do the following.

1. Use the Windows Explorer to locate your hub directory.
2. Right-click on the directory icon and select Properties from the menu that opens.
   The <hubdirname> Properties dialog will open.
   Check the cited <hubdirname> in the dialog header to make sure you are setting permissions for the correct directory.
3. Switch to the Security tab, then click the the Edit button.
   The Permissions for <hubdirname> dialog will open.
4. Check: SYSTEM does already appear in the list of Group or user names?
   • YES: go on to the next step.
   • NO: Add it now:
     1. Click the Add button.
        The Select User, Computer, Service Account, or Group dialog will open.
     2. Enter SYSTEM in the Enter object name to select field and click the Check Names button.
        If there is no such account, you will see an error dialog. Use the information in the dialog to resolve the error. In particular, you may need to make sure the "Built-in security principal" object type is selected.
     3. Once the SYSTEM name is successfully entered, click OK.
        You will be returned to the Permissions for <hubdirname> dialog.
5. Select SYSTEM, then use the checkboxes in the Permissions for SYSTEM field to allow Full Control of the directory and click OK.
   You will be returned to the <hubdirname> Properties dialog.
6. In the the <hubdirname> Properties dialog, check to make sure that there is now an entry for SYSTEM in the Group or user names field, and that selecting this entry shows that SYSTEM has full permissions.
   Once you are satisfied, click OK.

Part 2: Set the hub service to start as the SYSTEM account

Once you have ensured that the SYSTEM account has full control over the hub directory, you can make it the "owner" of the hub service.

1. Open the Services Control Panel:
   • Control Panel / Administrative Tools / Services
2. Locate the hub service in the table of services.
3. Right-click on the hub service name, and select Properties from the menu that opens.

   

   A properties dialog for the hub service will open.

4. Select the Log On tab of the dialog.
5. Select Local System Account.

   

6. Click OK.

The hub service will now run under the local system account (SYSTEM).

Links

• Typical CodeSonar Tasks
• The CodeSonar Hub
• CodeSonar as a Windows Service