How many Service Acccounts should each farm have?

Question

I have to rebuild two farms (DEV and QA), which were previously built using the GUI. Production will likely be rebuilt, but that's for another day.

How many service accounts are recommended for each farm? Minimum?

So far I have the following accounts: -Farm -Admin (setup) -Search -Application Pool

This is a single-server farm with SQL.

Answer 1

This is what we run for a medium/large farm:

SP_Farm Farm Account

SP_Sandbox  Sandboxed Code Service

SP_Search   Server Search Service, Search Service App Pool

SP_Crawl    Search Crawl

SP_Sync User Profile Sync, User Profile Service Proxy App Pool

SP_Usage    Web Analytics Processing Service, Web Analytics App Pool

SP_MetaData Managed Metadata Service

SP_Excel    Excel Services

SP_Secure   Security Token Service

SP_CacheReader  Object Cache Reader Account

SP_CacheUser    Object Cache Super User Account

SP_AppPool_<webname>    <webname> Web App Pool

SSRS_Web    SSRS Web Account 

SSRS_Windows    SSRS Windows Account

Answer 2

I prefer a minimalist approach, as there is no concrete security impacts and it improves performance:

• Farm Admin account
• Service Application account
• Web Application account
• Claims to Windows Token account
• Other service accounts, such as Portal Super User/Reader, SQL, UPSS Sync, and so forth that don't directly drive SharePoint Application Pools

I disagree with having a global "Admin" account as it removes accountability from the individual. In many regulated environments, such 'shared' accounts are not permitted by auditors.