Tag Info

Hot answers tagged

10

The farm account does not need to be a member of the local Administrator group. For a farm it should be a domain user, when you run the configuration wizard it will be granted the required user rights, file permissions, registry permissions, DCOM permissions, and DB permissions. When you do your initial Sync with UPS, you will need to add the farm account ...


5

in a nut shell: Managed Service Accounts. MSA’s allow you to create an account in Active Directory that is tied to a specific computer. That account has its own complex password and is maintained automatically. This means that an MSA can run services on a computer in a secure and easy to maintain manner, while maintaining the capability to ...


4

you need to create normal user accounts for the object cache accounts. They don't need to be service accounts, according to Mirjam van Olst


3

Microsoft SharePoint Server 2010 provides a number of compelling improvements designed especially for the system administrator, of these, commonly overlooked, are Managed Accounts. A Managed Account is effectively an Active Directory user account whose credentials are managed by and contained within SharePoint. In addition to storing the ...


2

Two things are absolutely critical with UPS... permissions, and doing the configuration in the right order. Spence Harbar has the 'gold standard' guide on how to setup UPS... follow it to the letter. Remember that when FIM is provisioned, it does so under the farm account, but the service should execute as another identity, and the synchronization as a ...


1

The Farm Account, which is used for the SharePoint 2010/2013 Timer service and the Central Administration site, is highly privileged and should not be used for other services on any computers in the server farm. You need to Change the Server farm account used for other services to low privileged account. This error may vary as per the services running in ...


1

Try the following code! I had a ghost managed account that I removed this way by having the object in a variable: $account = Get-SPManagedAccount -Identity <ACCOUNT_NAME> Remoeve-SPManagedAccount -Identity $account


1

You need to run the the ol school stsadm updatefarmcredentials


1

just take a look at: http://www.automism.at/2013/02/22/sharepoint-2013-managed-accounts-2/ the post contains pretty detailed Information about createing the Managed Accounts for SharePoint 2010/2013 the first post in that series also contains a PowerShell script to create the ActiveDirectory Accounts that are used for the Managed Accounts Bye


1

To return a list of managed accounts: Get-SPManagedAccount To create a new managed account: $appPoolUserName = "<domain>\<user_name>" $appPoolCred = Get-Credential $appPoolUserName New-SPManagedAccount -Credential $appPoolCred


1

I've been confusing 2 different, but related things. Both Active Directory and SharePoint have managed accounts. But SharePoint just refers to a normal AD account where you tell SP to auto update the password according to AD's password policy. AD means literally creating an account managed by AD without a password. You don't put an ad-managed-service ...


1

It is most likely the account you chose at the time of Sync Connection. The page does not validate the password, it just checks that the two boxes are the same. M


1

If this account is also a Managed Account (check in SP-CA under Security - Managed Accounts) it is possible that someone has configured the automatic password change - NEW IN SP2010. There is no way (that I know - but i'm not an expert) to find who changed a password in AD, but you can reduce to whom can change it and any way you need to turn on Auditing ...


1

It's not required that they are managed accounts, however, if your service account passwords expire you might as well register it for password changes.


1

A great article that might help Link


1

running SharePoint Server 2010 on Windows 7 is generally a bad idea and especially if you're using Local System and Network Service! To successfully run the User Profile Service App you need proper domain accounts. Don't waste your time to get this to work. Invest in a virtual machine (Hyper-V, VMWare, VHD boot) and run it on Windows Server with proper ...


1

It is SP 2010? Did you tried: Central Administration > Security > General Security > Configure service accounts > [Select One] Service Application Pool - SecurityTokenServiceApplicationPool or shortcut to it: http://[CA url]/_admin/FarmCredentialManagement.aspx


1

It is a best practice to create a specific service account per Service Application, so that the farm service account is only used for this specific purpose (health monitor will warn you if it is used for other services). With few exceptions these can each be made a managed account. Also create a service account per application pool, as this is a natural ...



Only top voted, non community-wiki answers of a minimum length are eligible