Hello,
I am working on the ability for an alert action to restart a machine on our domain. However, in order to do so I was curious as to what user context the program is ran with. In our instance, all Orion services are ran using the SYSTEM account, and in my testing the external programs are also ran under the SYSTEM user context.
However, where is this context inherited from? Is it whatever user context that is used to run a particular service (maybe the SolarWinds Alerting Engine service), or are all external programs ran as SYSTEM?