Hot answers tagged service-account
7
The farm account does not need to be a member of the local Administrator group. For a farm it should be a domain user, when you run the configuration wizard it will be granted the required user rights, file permissions, registry permissions, DCOM permissions, and DB permissions.
When you do your initial Sync with UPS, you will need to add the farm account ...
4
The first thing to keep in mind is that rights are being granted to service accounts, not accounts actually associated with a specific user. So these accounts should not be used to log into a server unless it is a highly specific and unique situation. In fact, you can optionally configure these accounts so that they cannot be used to log on to a server via ...
4
Not entirely sure why you add "except CA". Sure you can automate security using PowerShell. But this gives you only real value if you have multiple farm environments that you want to stay as much "the same" as possible.
The important thing here is to harden security for your farm, not really how you do it. As a primer you should read Plan security hardening ...
3
I would definately start from scratch!
The account used for install has special permissions, and if these have been intertwined with farm account it is a mess. You will spend far longer time trying to undo the security related problems in the previous install than starting over.
I usually define a managed account for each service application, one for each ...
3
PowerShell can, so by implication so can the SharePoint API, check out: http://technet.microsoft.com/en-us/library/ff724280.aspx#section1
and here too:
http://social.technet.microsoft.com/Forums/en/sharepoint2010setup/thread/c3e2960c-56e3-4693-bcd2-dc15250bd2a9
2
Alerts are generated in two phases. The first phase is done when the item is saved that would generate alert and that is done in the context of the application pool. It creates a summary of what changed on the item and saves that to a table inside SharePoint. The second is a Timer Job that checks all defined alerts against the table of changes and then ...
1
because i did a "by the book" installation all i had to do was:
Go to Central Admin
Go to Secutrity
Click Configure Managed Accounts
Edit the user you want and edit it
Check the box "Change Password Now"
Insert new password and Save
Celebrate!
1
I've been confusing 2 different, but related things. Both Active Directory and SharePoint have managed accounts. But SharePoint just refers to a normal AD account where you tell SP to auto update the password according to AD's password policy. AD means literally creating an account managed by AD without a password.
You don't put an ad-managed-service ...
1
It is a best practice to create a specific service account per Service Application, so that the farm service account is only used for this specific purpose (health monitor will warn you if it is used for other services). With few exceptions these can each be made a managed account.
Also create a service account per application pool, as this is a natural ...
1
The server was previously moved from one OU to another, picking up the GPO policy that sets the log on as batch permissions, but wasn't restarted afterwards or since. The user accounts that were running the previous Web Applications maintained their permissions, and it was only the new user accounts that were blocked. Removed the GPO restrictions, and ...
Only top voted, non community-wiki answers of a minimum length are eligible
