SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm confused about least privilege accounts during sharepoint 2010 farm setup. I found an article describing this approach here, where author says:

Specifically, SP_Farm must be in the local Administrators group of every server in the farm. You must manually add SP_Farm to the local Administrators group on a server before installing SharePoint on that server!

Doing as author suggests, leads to warning in sharepoint's central administration, saying that application pool identities or service accounts belong to computer administrators group. So basically what author is suggesting leads to an security issue. As far as I know, SP_Farm account should be in computer administrator group during Profile Synchronization provisioning, and should be removed from that group after being successfully provisioned. Am I right?

Also, as far I know, SP_Farm shouldn't be allowed to logon locally by server's local security policy. It shouldbe allowed only for provisioning profile synchronization, and then local logon should be disabled after provisioning profile synchronization.

I'd like to know if I'm correct. If I'm wrong - correct me, please.

share|improve this question
up vote 1 down vote accepted

That is right, the farm account should only be a local administrator when provisioning the User Profile Service Synchronization service. I gather the person in the quotes is talking about when actually installing the SharePoint software on the machine, which requires Administrator permissions, but can be done with any account with administrative privileges.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.