Can the NTSMF collection service impersonate a User Account to gain access to secured network resources?
Yes. By design, the NTSMF collection service (dmperfss.exe) is installed to run under the built-in LocalSystem (or, XP or .Net Server, SYSTEM) account. This built-in account, which most services use, has the authority to perform almost any internal function on the local machine. However, the LocalSystem account has no built-in facilities to access secure network resources, such as shared network folders. The NTSMF collection service performs two sets of functions where security considerations may apply: • Control the NTSMF data and log files in the \data\ Folder. You can normally tell that the NTSMF \data\ Folder is protected from uncontrolled access by the LocalSystem account if the service terminates prematurely at start-up and no
