Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

In my Review problems and solutions reports I have the following Security Warning:

Security Warning

Both of the offending services use my "farm" managed account (I named it SP_Farm on my domain, it's the one you have to enter during the SP configuration wizard when you're ready to set up the DBs).

Recently I went through a boot camp (got my MCTS: SharePoint 2010, Configuration cert) and as part of the course they told us that the farm account needed to be a local admin on the machine(s) where your SharePoint server(s) is(are) installed.

My question is: How will it affect my server if I remove SP_Farm from the local administrators group on my server?

share|improve this question

2 Answers 2

up vote 10 down vote accepted

The farm account does not need to be a member of the local Administrator group. For a farm it should be a domain user, when you run the configuration wizard it will be granted the required user rights, file permissions, registry permissions, DCOM permissions, and DB permissions.

When you do your initial Sync with UPS, you will need to add the farm account to the local admins on the machine doing the sync, but this only for the first sync, after which you can remove it from the admin group.

Technet guides to refer too:

Plan for administrative and service accounts

Plan Administrative tasks in least privileged environment

It should not affect your farm to remove it from the admin group, but after removing the permissions (and rebooting), you may want to have SP reset the security settings. You can do this via Powershell so you don't have run the entire psconfig wizard.

Initialize-SPResourceSecurity
share|improve this answer
    
Agreed. But some times Third Party Backup software may require local admin privileges –  Rajesh Oct 31 '11 at 5:10
1  
Your third party backup software shouldn't be using the farm service account, but instead a dedicated service account that has been granted the appropriate permissions on the servers and in the farm. –  shufler Aug 13 '13 at 18:07

A great article that might help Link

share|improve this answer
1  
Hi @Paul-akerlind please add some context on your external link to the question itself and then link to the answer. We like to keep the answers in-site, and external links tend to die! Please fix this. Thanx –  Anders Rask Oct 31 '11 at 11:34

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.