Windows installer should grant VSA user permissions to access machine cert storage

[lstipakov]

Since we now run persistent connections under unprivileged account, we broke a use case when those connections use certificates from machine store. We need to grant the permissions to our VSA user (NT SERVICE\OpenVPNService) to access machine storage.

[cron2]

Any progress on this? Might it make 2.7.2, tentatively planned for April 22?

[buchpat]

Hi.

Is it even possible to grant the VSA account access to the machine certificate store without giving it administrator rights? I couldn't find any built-in permission group/user that had access other than Administrators.

Maybe a workaround, a installer parameter that allows the service to keep running as Local System instead of the VSA account (NT SERVICE\OpenVPNService). This would restore the previous behavior where the service had access to the machine certificate store.

Additionally, this setting should persist across updates. Currently the installer resets the service account on every upgrade, which breaks any manual configuration changes.

Something like SERVICE_ACCOUNT=LocalSystem as an MSI property would be sufficient for unattended installs.