Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

So we're setting up a SharePoint farm and it seems our admin accounts require access SharePoint_Shell_Access role on SQL.

Why is this necessary? We've configured service accounts to connect to SQL and our accounts are FARM admins.

The reason behind the question is that we're facing understandable resistance from our client's DBAs to grant the role and the technet articles don't provide a great level of detail to justify the requirement.

share|improve this question
    
I like the answers by both SPDoctor and MichaelF (upvoted both). Still pondering the "why did they design it like this" question though. –  Neil Richards May 17 '11 at 15:19
    
There is an implicit assumption in the question "why did they design it like this". Like many Microsoft products, it has probably evolved through different products and revisions into its present form. –  SPDoctor May 23 '11 at 21:42

4 Answers 4

up vote 6 down vote accepted

The SharePoint_Shell_Access role gives you access to the content databases and the configuration database, and permission to execute the stored procedures. The farm administrator (not to be confused with the farm account) does not automatically have access to the content dbs.

It can also grant you the role of "difficult SharePoint person" from the perspective of the DBAs.

Background information on TechNet.

share|improve this answer
    
Ah, the weight of Technet is always helpful. It doesn't fully explain why they created the dependency, but helpful nonetheless. Seems to me they should have run the commands using the context of the appropriate account, but perhaps there are good reasons. –  Neil Richards May 17 '11 at 15:15
    
I assume that there is some security reason why a distinct role is required, or at least was required in some previous iteration of the product. –  SPDoctor May 23 '11 at 21:46

I believe it's permission related, we didn't have as much resistance in doing that here, but I think the reason is this:

In order to use PowerShell, an administrator must be assigned the SharePoint_Shell_Access role on any databases against which PowerShell will be used. For example, to perform tasks that read or manipulate data in the configuration database, an administrator must have the SharePoint_Shell_Access role for the configuration database. Likewise, to work with a specific site collection, the admin must have the SharePoint_Shell_Access role for the appropriate content database.

This is the location I found this in awhile ago: http://www.sharepointpromag.com/article/sharepoint/t-is-a-privilege-to-powershell

share|improve this answer
    
Good article. I have similar thoughts to the ones I shared with SPDoctor, I understand that there is a dependency, just wished there was a good reason why. The author clearly highlights the separation of concern issue, but why why why? –  Neil Richards May 17 '11 at 15:18

SharePoint_Shell_Access role membership is required to allow the user to run specific stored procedures that access sharepoint IO resources, that's why Add-SHShellAdmin also dd user in the WSS_Admin_WPG to allow the user to access this IO files. for example, this role is required to allow the user to access blob stor for sharepoint RBS.

i hope my answer to add value

share|improve this answer

The right should be granted when you run the add-spshelladmin cmdlet in Powershell. Have you tried that?

share|improve this answer
    
That's not my question. I know how to add the permission. I want to understand what is happening to mandate its need. Otherwise I have to have a conversations with DBAs without a decent explanation. –  Neil Richards May 17 '11 at 11:46
    
Sorry I have misinterpreted your question. It is an extra layer of security. Even as a farmadministrator (except for the setup account) you do not have permission to execute all stored procedures / tables in the config db and/or contentdbs. So granting the right extends what you can do far beyond the scope of a normal farmadmin so that's why the extra layer of security is added. Also means you have to choose wisely on who to grant this power to. –  Roel Hans Bethlehem May 17 '11 at 12:12

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.