THE INFORMATION IN THIS ARTICLE APPLIES TO:

• EFT v8.1 and later

DISCUSSION

Services Security 

To ensure proper operation, the EFT Server, DMZ Gateway, and related modules must have appropriate access to requisite folder paths, registry locations, and program execution components.
Generally, the EFT service is set to be an administrator of the system or domain. This may work for a time but can impose a problem in the future if permissions become restricted/de-escalated. These permissions settings are recommended so that if, in the future, the EFT Service account becomes more restrictive, interruption in service will be minimized or prevented.

For best security, you should set the least permissions necessary to run EFT on Windows Server 2022 and Windows Server 2019.

Instructions are provided below.

Once the service account is created, ensure the account follows the least privileged access as:

Open Component Services > Computers > My Computer > DCOM Config or run dcomcnfg.exe

Access Permission

A specific domain account (<EFTServiceAccount>) is recommended to run the EFT or DMZ gateway. The following table defines the recommended permissions.

*NOTE: You may use different Full Control if you use an AD auth site with permissions managed by Windows, as the EFT Service will impersonate using the client's credentials to access these folders instead of using the service account. Combined with “Alternative Credentials” at each event rule and action. This is only recommended when creating a new empty site for the first time. Otherwise, you must inspect all event rules and Workflow to ensure they work correctly.

** Windows Temp location: Ensure the hard drive where Windows temp is located (e.g., C:\Windows\TEMP ) has enough space and fast write/read operations. Automate (EEFT Advanced Workflows module) uses it as scratch disk space for certain operations (PGP, compression, etc).

​

​Also refer to Security Best Practices.