Take the 2-minute tour ×
SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. It's 100% free, no registration required.

I am working through setting up my search service app and came across a question of why I would use another domain account to crawl my web applications. Currently i've just set it to my farm account, I've seen some documentation that supports the idea of an isolated search domain account for just crawling however and now i'm curious why this would be leveraged, aside from security isolation.

Thoughts?

Thanks!!

share|improve this question
    
Thank you both for your replies, I consider them both answers to my question but can only mark one of them as the true answer...therfore i will not do so as i find them both equally as helpful.... –  Jacob A Jun 5 '12 at 13:10
    
I did find a similar article on the stack that covered how the account actually crawls content in the farm. sharepoint.stackexchange.com/questions/35087/… –  Jacob A Jun 5 '12 at 13:13
add comment

3 Answers

The primary reason is that it is recommended to use your farm account for a few services as possible. That account has privileged access to your farm and your servers, so the idea is that by limiting the number of services using that account you are reducing the amount of security risks on your farm.

All that a search service account needs is full read access to each web application.

share|improve this answer
add comment

Content access account need only read SharePoint content, so assigning any more rights or allowing the crawler to run as an administrator or database owner (e.g. using the application pool identity) creates a prime attack surface. Don't do that.

The "best practice" is to use the same account wherever you have the same permission or auditing requirements for two operations, and distinct accounts for each potential attack surface.

share|improve this answer
add comment

The reason for a different domain account for search is because if you use an account with full control, it has access to read draft items, and so draft items would return in search results to people that don't have access to read the draft item.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.