|
I am working through setting up my search service app and came across a question of why I would use another domain account to crawl my web applications. Currently i've just set it to my farm account, I've seen some documentation that supports the idea of an isolated search domain account for just crawling however and now i'm curious why this would be leveraged, aside from security isolation. Thoughts? Thanks!! |
|||||
|
|
The primary reason is that it is recommended to use your farm account for a few services as possible. That account has privileged access to your farm and your servers, so the idea is that by limiting the number of services using that account you are reducing the amount of security risks on your farm. All that a search service account needs is full read access to each web application. |
|||
|
|
|
Content access account need only read SharePoint content, so assigning any more rights or allowing the crawler to run as an administrator or database owner (e.g. using the application pool identity) creates a prime attack surface. Don't do that. The "best practice" is to use the same account wherever you have the same permission or auditing requirements for two operations, and distinct accounts for each potential attack surface. |
||||
|
|
|
The reason for a different domain account for search is because if you use an account with full control, it has access to read draft items, and so draft items would return in search results to people that don't have access to read the draft item. |
|||
|
|
