What does "Running Cerberus FTP Server as LocalSystem is a security risk. Using a less privileged account is recommended" mean?

What does this mean? 

You should only see this message if you have updated Cerberus from a version below release 12.3. Prior to Cerberus version 12.3, the LocalSystem account was the default Windows account used to run the Cerberus FTP service when you install the application. 

You may continue to use the LocalSystem account. However, the privilege level of this account on the local machine is greater than the privilege level required by the Cerberus FTP service. 

In accordance with the security best practice of “principle of least privilege,” we recommend that you create a local computer account to specifically run the Cerberus service or use a Domain Service Account. 

What will happen if I continue to use the LocalSystem account?

You may continue to use the LocalSystem account but be advised that compromising Cerberus FTP Server could grant an attacker administrative access to the server.

How can I change the service account? 

Before making any changes to the Cerberus FTP service account:

• You must ensure the new service account has permissions on all virtual directory paths used by Cerberus FTP Server. Files referenced in configuration, like certificates and private key files, must also be accessible.
• You must ensure the new service account has permissions on the Cerberus settings at C:\ProgramData\Cerberus LLC\Cerberus FTP Server
• If moving to a domain service account, you must also ensure the account has read-access to all users and groups integrated with Cerberus FTP Server.

Upgrade Cerberus

If running a Cerberus version older than 12.3, upgrading to the latest version of Cerberus will walk you through configuring the service credentials. 

1. Create a local user account that has all the necessary permissions. Note: be sure to set the password to never expire.
2. Download and install the Cerberus installer. 
3. At the service credentials prompt, select “Existing Local Account”
4. You will then be prompted for the username and password for the local account. 
5. Press Validate to check the username and password. 

Changing the Cerberus FTP Service Account Using the Windows Service Manager

1. Open the Administrative Tools > Services window on your Windows server.
2. Stop the Cerberus FTP service.
3. Open the Properties > Log On dialog.
4. Change the service user account to the local user account or domain account. 
5. Start the Cerberus FTP service.