Run services with service accounts

Milestone recommends that you create service accounts for services related to XProtect VMS, instead of using a regular user account. Set up the service accounts as domain users, and only give them the permissions required to run the relevant services. See Kerberos authentication (explained). For example, the service account should not be able to log on to the Windows desktop.

Learn more

The following control(s) provide additional guidance:

• NIST 800-53 AC-5 Separation of Duties
• NIST 800-53 AC-6 Least Privilege