Sorry, I've been away for a few days, just back today.

I have tried the registry change and starting the corresponding Service
to no avail, doesn't change anything. I do appreciate your tip on how to
properly setup a Service so that it can interact with the Desktop, will
look into that as soon as I have a chance.

2 side notes on your last 2 points:

- The "desired config" worked perfectly under Win2008R2 so I know it's
what I want, but rules could change under 2012R2.
- The driving factor for our Policy is not "least privilege" it is for
accountability and easily be able to identify which system runs which
process.

Thank you for your help.


--
pplante
------------------------------------------------------------------------
pplante's Profile: https://forums.netiq.com/member.php?userid=3310
View this thread: https://forums.netiq.com/showthread.php?t=54560