Security Considerations

By default, pasUnity uses the LOCAL SERVICE account to run the pasUnity Processor Agent and by extension all of the jobs and job steps that are being executed. The LOCAL SERVICE account is not a very powerful account and was specifically chosen to limit the negative effects of pasUnity job steps on the host machine and to allay fears that pasUnity could access resources it was not intended to.

Because the LOCAL SERVICE account is not very powerful, you may wish to provide an alternate security identity for certain job steps (such as the Command Line job step) to execute under using the username and password fields.

You may also modify the pasUnity Processor Agent service configuration to use a different service identity, such as the more powerful LOCAL SYSTEM account or a Windows Domain user account, if you need access to network resources. While this is supported, it is recommended that rather than change the service account for the pasUnity Processor Agent that you grant the appropriate permissions to the LOCAL SERVICE account to perform tasks as needed, or provide alternate credentials at the job step level.

Send comments on this topic.