Tag Info

Hot answers tagged

8

The farm account does not need to be a member of the local Administrator group. For a farm it should be a domain user, when you run the configuration wizard it will be granted the required user rights, file permissions, registry permissions, DCOM permissions, and DB permissions. When you do your initial Sync with UPS, you will need to add the farm account ...


4

The first thing to keep in mind is that rights are being granted to service accounts, not accounts actually associated with a specific user. So these accounts should not be used to log into a server unless it is a highly specific and unique situation. In fact, you can optionally configure these accounts so that they cannot be used to log on to a server via ...


4

Not entirely sure why you add "except CA". Sure you can automate security using PowerShell. But this gives you only real value if you have multiple farm environments that you want to stay as much "the same" as possible. The important thing here is to harden security for your farm, not really how you do it. As a primer you should read Plan security hardening ...


3

PowerShell can, so by implication so can the SharePoint API, check out: http://technet.microsoft.com/en-us/library/ff724280.aspx#section1 and here too: http://social.technet.microsoft.com/Forums/en/sharepoint2010setup/thread/c3e2960c-56e3-4693-bcd2-dc15250bd2a9


3

I would definately start from scratch! The account used for install has special permissions, and if these have been intertwined with farm account it is a mess. You will spend far longer time trying to undo the security related problems in the previous install than starting over. I usually define a managed account for each service application, one for each ...


2

The server was previously moved from one OU to another, picking up the GPO policy that sets the log on as batch permissions, but wasn't restarted afterwards or since. The user accounts that were running the previous Web Applications maintained their permissions, and it was only the new user accounts that were blocked. Removed the GPO restrictions, and ...


2

It's all about the Principle of Least Access. For one thing, you pretty much never want to force your farm account to change passwords every X amount of time because that farm account is used for a ton of internal processes ranging from deciding to run timer jobs on your various servers to (at least prior to 2013) getting permission to crawl over your user ...


2

Alerts are generated in two phases. The first phase is done when the item is saved that would generate alert and that is done in the context of the application pool. It creates a summary of what changed on the item and saves that to a table inside SharePoint. The second is a Timer Job that checks all defined alerts against the table of changes and then ...


2

There are a few more considerations when you are hardening a Sharepoint box. Kerberos, SQL Aliases, firewall policies and fine grained permission policies on the box itself. I recommend that you take a look at http://technet.microsoft.com/en-us/library/cc288143%28v=office.14%29.aspx and get familiar with SQL Hardening as well ...


2

Form my previous experience, SharePoint Search service account(sp_search in your case) needs to be added to Local admin group when you are configuring search and after configuration, it can be removed from local admin group. This setup is not required for other Service accounts(except User Profile service which also requires a admin access when ...


1

Two things keep in the mind, which we mixed up all the times, Install Account & Farm Admin Account. Farm Admin account is used for running the Central Admin and timer Services and required the elevated permissions. Never this account for the installation & daily task. Install Account: this account is responsible for all the Installation, ...


1

I'm assuming this is an on-premise installation. Typically, if someone leaves the company, they will no longer have access to your intranet. Even so, if your data is that important within SharePoint, then it is important enough to have a password change policy that can be reliably enforced. Microsoft has a great technet article for account setup and ...


1

In addition, you should consider using sp_superuser and sp_superreader accounts for caching. As far as "eliminating sp_workflow and sp_report and just use sp_serviceapps", I would suggest that you do not take that approach. Separating service accounts by role will help your farm function well and it will enable you to troubleshoot problems more effectively ...


1

1.) i would recommend to separate set for each farm, your fear is correct and that happens many times. so don't risk your Production. 2.) Best Practice is always recommend to use a separate account which perform Installation, configuration, Routine Maintenance, Pathes/CU and day to day operation i.e powershell. From your list sp_install is the account which ...


1

You cannot access this feature if your account is not Local Admin on the SharePoint server even you are Farm Admin. SharePoint grab this information from IIS and if you are not local admin the you cannot access the IIS...another check you can do, try to create a new webapplication that option will be grayed out for you. either add yourself as local admin ...


1

Sounds like you need to read up on SharePoint security :-) You should never ever log in as any service account, that is why they are called service accounts: they are exclusively used for services! There are many good reasons for this, one of them being the one you mention regarding lockout, another being security. This account also have no special ...


1

Service application is something like a SharePoint plugin. Basically it provides some big piece of functionality you can later use througout your farm. You can develop your own custom service applications, and also SharePoint includes a whole bunch of OOTB service applications, like User Profile Service, Secure Store Service, etc. Service applications are ...


1

because i did a "by the book" installation all i had to do was: Go to Central Admin Go to Secutrity Click Configure Managed Accounts Edit the user you want and edit it Check the box "Change Password Now" Insert new password and Save Celebrate!


1

I've been confusing 2 different, but related things. Both Active Directory and SharePoint have managed accounts. But SharePoint just refers to a normal AD account where you tell SP to auto update the password according to AD's password policy. AD means literally creating an account managed by AD without a password. You don't put an ad-managed-service ...


1

You have two main options: Give the AppPool access to the database and run your database code inside SPSecurity.RunWithElevatedPrivileges Use Windows impersonation LogonUser around your database code. See section 3. Using Win32 API in Impersonation in SharePoint : An Extreme Overview. The big question is then where to store the username/password. It can ...


1

Can you try this: One thing to remember is that crawling SharePoint sites is different from crawling file shares or non-SharePoint websites. A few other quick pointers: •the sps3: protocol is for crawling user profiles for People Search. You can disregard anything the crawler says about it until you're ready for user profiles. •your crawl account is ...


1

It is a best practice to create a specific service account per Service Application, so that the farm service account is only used for this specific purpose (health monitor will warn you if it is used for other services). With few exceptions these can each be made a managed account. Also create a service account per application pool, as this is a natural ...



Only top voted, non community-wiki answers of a minimum length are eligible