Patent ID: 9501635
Filing Date: 2016-11-22
CPC Classification: G06F

Claim Text:
1. A method for creating a credential managed account, implemented at least in part by a processor of a computing device, the method comprising: creating, by the processor, a new password managed account under a computing device organizational unit; defining, by the processor, the new password managed account to access a low privilege service on a managed computing device, the low privilege service having limited privileges; identifying, by the processor, the new password managed account for a lifecycle; providing, by the processor, a new privilege that allows the low privilege service to impersonate a context of a non-administrator user; isolating, by the processor, the low privilege service from a trusted computing base, wherein isolating the low privilege service includes removing a trusted computing base privilege associated with the low privilege service; impersonating a context of the non-administrator user, by a process associated with the low privilege service, at an identity level by using a limited impersonation token subsequent to the removal of the trusted computing base privilege; creating a random password for the new password managed account; storing the random password in a central directory database; creating a local security authority secret for the random password; automatically updating, by the processor, the new password managed account by changing the random password for the new password managed account on a periodic basis; and registering the low privilege service with a service control manager and configuring the low privilege service to operate under the new password managed account.