5

So we're setting up a SharePoint farm and it seems our admin accounts require access SharePoint_Shell_Access role on SQL.

Why is this necessary? We've configured service accounts to connect to SQL and our accounts are FARM admins.

The reason behind the question is that we're facing understandable resistance from our client's DBAs to grant the role and the technet articles don't provide a great level of detail to justify the requirement.

Improve this question
2
  • I like the answers by both SPDoctor and MichaelF (upvoted both). Still pondering the "why did they design it like this" question though.
    – Neil Richards
    Commented May 17, 2011 at 15:19
  • There is an implicit assumption in the question "why did they design it like this". Like many Microsoft products, it has probably evolved through different products and revisions into its present form.
    – SPDoctor
    Commented May 23, 2011 at 21:42

4 Answers 4

Reset to default
7

The SharePoint_Shell_Access role gives you access to the content databases and the configuration database, and permission to execute the stored procedures. The farm administrator (not to be confused with the farm account) does not automatically have access to the content dbs.

It can also grant you the role of "difficult SharePoint person" from the perspective of the DBAs.

Background information on TechNet.

Improve this answer
2
  • Ah, the weight of Technet is always helpful. It doesn't fully explain why they created the dependency, but helpful nonetheless. Seems to me they should have run the commands using the context of the appropriate account, but perhaps there are good reasons.
    – Neil Richards
    Commented May 17, 2011 at 15:15
  • I assume that there is some security reason why a distinct role is required, or at least was required in some previous iteration of the product.
    – SPDoctor
    Commented May 23, 2011 at 21:46
5

I believe it's permission related, we didn't have as much resistance in doing that here, but I think the reason is this:

In order to use PowerShell, an administrator must be assigned the SharePoint_Shell_Access role on any databases against which PowerShell will be used. For example, to perform tasks that read or manipulate data in the configuration database, an administrator must have the SharePoint_Shell_Access role for the configuration database. Likewise, to work with a specific site collection, the admin must have the SharePoint_Shell_Access role for the appropriate content database.

Read more at SharePoint Service Account Best Practices 2019/2016

Improve this answer
1
  • Good article. I have similar thoughts to the ones I shared with SPDoctor, I understand that there is a dependency, just wished there was a good reason why. The author clearly highlights the separation of concern issue, but why why why?
    – Neil Richards
    Commented May 17, 2011 at 15:18
1

SharePoint_Shell_Access role membership is required to allow the user to run specific stored procedures that access sharepoint IO resources, that's why Add-SHShellAdmin also dd user in the WSS_Admin_WPG to allow the user to access this IO files. for example, this role is required to allow the user to access blob stor for sharepoint RBS.

i hope my answer to add value

Improve this answer
-1

The right should be granted when you run the add-spshelladmin cmdlet in Powershell. Have you tried that?

Improve this answer
2
  • That's not my question. I know how to add the permission. I want to understand what is happening to mandate its need. Otherwise I have to have a conversations with DBAs without a decent explanation.
    – Neil Richards
    Commented May 17, 2011 at 11:46
  • Sorry I have misinterpreted your question. It is an extra layer of security. Even as a farmadministrator (except for the setup account) you do not have permission to execute all stored procedures / tables in the config db and/or contentdbs. So granting the right extends what you can do far beyond the scope of a normal farmadmin so that's why the extra layer of security is added. Also means you have to choose wisely on who to grant this power to.
    – Roel Hans Bethlehem
    Commented May 17, 2011 at 12:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.