From d59c5d2c8fefd161adb342a291ddec10ac56c3c0 Mon Sep 17 00:00:00 2001
From: Lev Stipakov <lev@openvpn.net>
Date: Wed, 12 Mar 2025 16:51:39 +0200
Subject: [PATCH] msi: Change OpenVPNService account

Instead of running as SYSTEM, run as limited
virtual service account "NT SERVICE\OpenVPNService",
which is much more secure.

This requires service to use interactive service.

Signed-off-by: Lev Stipakov <lev@openvpn.net>
---
 windows-msi/msi.wxs | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/windows-msi/msi.wxs b/windows-msi/msi.wxs
index 82151192..0f3822f2 100644
--- a/windows-msi/msi.wxs
+++ b/windows-msi/msi.wxs
@@ -490,8 +490,9 @@
                                 Description="Responsible for automatic start of OpenVPN instances."
                                 Type="ownProcess"
                                 Start="disabled"
+                                Account="NT SERVICE\OpenVPNService"
                                 ErrorControl="normal">
-                                <ServiceDependency Id="Dhcp"/>
+                                <ServiceDependency Id="OpenVPNServiceInteractive"/>
                             </ServiceInstall>
                         </Component>
                         <Component Id="bin.tapctl.exe" Guid="{5A294591-0F71-470F-977B-DD288AB2B437}">