Mongodb Network Service User Vs Local Or Domain User
The built in network service user account has fewer access privileges on the system than the local system user account.
Mongodb network service user vs local or domain user. For an existing local user account specify a period i e. This is never good. Local users and domain users in windows local users. The network service is effectively an unprivileged user that authenticates as the computer s domain account when accessing remote resources.
It also creates a situation where the user can attack the network from a computer that is part of the domain. Run the service as network service user default this is a windows user account that is built in to windows. When you log in as a local user the computer checks its own list of users and its own password file to see if you are allowed to log into the computer. Our documentation guides our windows users to configure mongodb to run as a local system account equivalent of an admin permission on the machine.
To create a shard local administrative user connect directly to the shard and create the user. To connect to your local mongodb you set hostname to localhost and port to 27017. The built in local system user account has no password has a high level of access privileges. The worst possible case is to allow a user to logon with local administrative privileges which is impossible to control.
Assuming that your domain account is just a member of the users group on the machine where the service is running its permission to the local machine will be the same as network service but the. Press connect and you should see the databases in your local mongodb. These values are the default for all local mongodb connections unless you changed them. When you open mongodb compass you ll see a screen that looks like this.
It is part of the administrators group and it presents the computer s credentials to remote servers. However some maintenance operations such as cleanuporphaned compact rs reconfig require direct connections to specific shards in a sharded cluster to perform these operations you must connect directly to the shard and authenticate as a shard local administrative user. Removing all local user accounts forces the user to logon using a domain user account. It is part of the users group but the network.