Skip to content

Running PVS Forge with a service account

PVS Forge needs credentials to reach your PVS servers and master targets, and it stores them so it can run jobs unattended. Use a dedicated service account for this — not a personal administrator account. This page explains why and lists exactly which rights the account needs.

Why a dedicated service account

PVS Forge keeps the credentials you enter so it can connect on every run. Tying that to a personal account causes two real problems:

  • Password rotation breaks access. Personal admin accounts (for example tiered T1/T2 accounts) are rotated regularly. Every rotation invalidates the credentials stored in Forge, and someone has to re-enter them by hand before the next job works.
  • It blurs the tier boundary. On a shared Forge installation, a second administrator could trigger jobs that run with the stored credentials — that is, act under the first administrator's identity. A dedicated account keeps that line clear.

Recommendation: create a single, dedicated service account (for example svc-pvsforge) with exactly the rights listed below and a controlled password (one that is not rotated, or rotated deliberately as a managed step).

Required rights (least privilege)

Grant only what is listed here — PVS Forge does not need domain-wide administrative rights.

Domain

  • A standard domain user. Not a Domain Admin.

PVS servers (every server in the farm)

  • PVS Farm Administrator role in the PVS console — the minimum role to create and change disk locators, run a sync, and manage load balancing.
  • Member of the local Administrators group on each PVS server — for local volume queries, temporary firewall rules, and running local scripts.
  • Write access (SMB) to all stores — for vDisk sync and VHDX placement.

Master targets

  • Member of the local Administrators group — for agent deployment, scheduled task registration, and imaging/sealing (disk operations require elevation).
  • WinRM access (Kerberos) — PVS Forge connects to WinRM by hostname / FQDN.

How PVS Forge runs

  • The PVS Forge UI runs interactively as this service account — or as a signed-in administrator who has entered the service account's credentials in Forge. It does not run in the SYSTEM or a service context.
  • Run Forge on a PVS server of the farm.

One credential set, or two for a tiered setup

Out of the box PVS Forge uses one set of credentials for everything. A second PVS Server credentials set is only needed when the master target and the PVS store sit in different security tiers. See Settings → Credentials and the tier concept.

How the password is stored

The credentials you enter are stored locally on the machine that runs PVS Forge, inside its configuration. Passwords and API keys are encrypted with Windows DPAPI, bound to that machine — so the stored value is only readable on the machine where it was entered, and never in clear text. They are never written to logs.

Because the encryption is bound to the machine, you re-enter the credentials once if you rebuild or replace that machine. Any administrator signing in to the same machine can use Forge with the stored credentials, so still treat it as a trusted host and restrict who can sign in to it.