WCF Windows服务权限问题

Question

I have created a WCF service and hosted it using Windows Services host. To install the project I created an installation project (as described here ). In the tutorial, it says to define in the ProjectInstaller.cs the serviceProcessInstaller1 Account property to be Network Service . When using this setting the service did not started on the server. When I tried to start the process manually, it immediately returned to stopped state.
After when I changed the Account to LocalSystem the service works properly. My questions are:

1. Any ideas why it won't work with Network Service account?
2. What are the security implications of using a server with LocalSystem account? This server is used locally in the intranet as a reporting server for other servers.

Answer 1

1. Network Service does not have proper priviligies to run a WCF host using named pipes (see http://weblogs.thinktecture.com/cweyer/2007/12/dealing-with-os-privilege-issues-in-wcf-named-pipes-scenarios.html ).
2. See http://www.windowsitpro.com/article/services/understanding-the-local-service-and-network-service-accounts.aspx for a description about the differences between those accounts. The LocalSystem is a local administrative account that can cause a lot of trouble if exploited by an attacker. The Network Service account has much less access and is because of that better to use.