Windows account prerequisites
before you run the installer
The account you install with must be a local administrator. Separately, the account the Universal Broker service runs as needs the user rights below — or you can let it run as Local System. A system install creates the UBrokerService account with these rights automatically if it does not already exist.
| User right | What Universal Agent needs it for |
|---|
| Act as part of the operating system | Lets the Broker build a logon token for another user, so tasks can run under the account the Controller specifies instead of the service account. |
| Log on as a service | Required for the Universal Broker service to start at all under this account. |
| Replace a process level token | Hands the token it created to the child process it launches for each task. |
| Impersonate a client after authentication | Lets the Broker act on behalf of the authenticated user when checking access to files and resources. |
| Adjust memory quotas for a process | Sets the memory quota on the task processes it spawns for other users. |
| Increase scheduling priority | Adjusts process priority so component and task processes get scheduled predictably. |
| Bypass traverse checking | Reaches working directories, scripts and spool files through paths whose parent folders it cannot list. |
| Debug programs | Opens and manages the task processes it started — status, resource usage and termination. |
| Take ownership of files and other objects | Manages files and spool data left behind by tasks that ran as other users. |
＋Extra rights for a system installhardening the service account
A system install also sets Access this computer from the network, plus the deny rights Deny log on as a batch job, Deny log on locally and Deny log on through Terminal Services. The deny rights are protective: the service account is powerful, so it is blocked from being used to sign in interactively or submit batch jobs.
＋Using a domain accountAD policy
A domain account must be granted these rights on the local machine or through Active Directory policy. Depending on the environment it may also need to be in Domain Admins so it is recognised consistently across the domain.
＋Local System insteadsimplest option
Running the Broker as Local System avoids managing these rights and password expiry, but the service then holds full local machine authority and cannot use a domain identity for network access. Prefer a dedicated service account where domain resources or least privilege matter.
Source: Stonebranch — Installation Requirements and Summary (Windows)