By Jeffrey Hicks
For the most part, services run under generic system based accounts, such as
LocalSystem or NT AUTHORITY\LocalService. But occasionally, a service needs to
be run under a “real” user account, either domain or machine-based. Too often
I’ve seen these running under an administrator account. In any event, you should
know where these types of service accounts are being used.