Setting Up a User Account for the SAP Mobile Platform Windows Service

Use a user account to run the SAP Mobile Platform Windows service, rather than a local administrator account. This limits the amount of damage an attacker can cause to your entire system.

By default, the SAP Mobile Platform Windows service runs under a local administrator account. Local administrators have many Windows permissions that are not required for SAP Mobile Platform. For example, local administrators can change files under Program Files and System32 directories, and can modify registry entries. If SAP Mobile Platform Server is compromised by an attacker, the attacker will be able to exploit these additional administrator permissions to damage your system. By running SAP Mobile Platform under a user account, which has fewer permissions, you limit the damage an attacker can cause.

The Windows administrator can change the SAP Mobile Platform Server service account to a user account after SAP Mobile Platform Server is installed.

Note: The Windows administrator must also change the SAP Mobile Platform service account to a user account after reconfiguring the Windows service as a result of server configuration changes.

Create a user named smpServiceUser using the command line or Windows Control Panel.

Note: You can also use an existing account for the SAP Mobile Platform service.
Give smpServiceUser a strong password and set the password to never expire.
Give smpServiceUser permission for full control of the server folder SMP_HOME\Server using the command line or Windows Explorer.

Note: Reduce the permissions for other users, based on their need to access SAP Mobile Platform Server files.
Click the Windows Start button, right-click the <your computer name> shortcut and select Manage.
Expand Services and Applications and select Services.
Right-click SAP Mobile Platform Server and select Properties.
Select the Log On tab.
Click This Account.
Enter smpServiceUser and the password.
Click OK.