0

So I did an install of SP2016 as my farmadmin account, and now it's my understanding that it's best practice to change the services to run under a variety of service accounts. For this go, I'm trying to have the following, based on a number of sites/guides I've read:

SPServicesSvc (General service acct to run services) SPWebAppSvc (Sometimes seen this called SP_Pool - to run Web Apps in IIS) SPSearchSvc (To run search services) SPTimerSvc (To run timer service) SPUserProfileSvc (To run User Profile service)

This is all in addition to the Farm Admin account.

In Central Admin, under Security -> Manage Service Accounts I was able to:

  • change the default to SPServicesSvc, and any other general services that were originally FarmAdmin from the install.
  • change the search services to SearchSvc.
  • change the Sharepoint - 80 Web App Pool to SPWebAppSvc.

However, this is where it starts to fall apart a bit:

  • The Central Admin app pool isn't there, the way Sharepoint - 80 is, so I'm not sure the best way to change that. I know that just changing it in IIS isn't sufficient, but not sure what is. Nor do I understand why it's missing in the GUI.

  • The Timer service also isn't there. For this case, I read somewhere it's okay to change this in the Windows Services screen directly. Does that seem right?

  • A couple of services under Security -> Manage Service accounts allowed me to change them, but when I look under IIS I still see those listed as the Farm Admin account (even though others, like Sharepoint - 80, do in fact reflect the GUI changes under IIS). These include "Service Application Pool - SharePoint Web Services System" and "Service Application Pool - SecurityTokenServiceApplicationPool". I've tried restarting the services, restarting IIS, rebooting the whole machine...nothing. They remain different in each place.

The User Profile Service seems immensely complicated, so I haven't even tried that one yet...

So the questions I have are - 1. is this even an okay plan in the first place? Most of what I've read seem to highly encourage changing these accounts, but is varied as to how many accounts need to be made/involved. And 2. if this is generally okay, how do I overcome the issues in part two above? (The ones that I haven't been able to change.)

Thank you!

Improve this question

1 Answer 1

Reset to default
1

Central Administration and the Timer Service are run by the Farm Administrator account. You do not need to change these, but you can certainly change what service account runs them (it then becomes your Farm Admin account):

stsadm –o updatefarmcredentials –userlogin DOMAIN\username –password passWord

I generally run Search under the same service account as what your "SPServicesSvc" is fulfilling. Not much need to separate it out.

The following services must run as the Farm Administrator:

  • Central Administration
  • Timer Service
  • Security Token Service Application Pool
  • SharePoint Web Services System
Improve this answer
7
  • I don't want to change the Farm Admin account, though - it's a custom account made for the purpose, and it's fine. I'd just been advised to break the web front-end and the timer services out onto different accounts from the admin, for security purposes. You're saying you don't feel there's an advantage there?
    – teleute00
    Commented Mar 3, 2016 at 18:19
  • You're correct in stating that the Web Application(s) and Services (with a few exceptions) should be broken out into two (preferably) service accounts. That said, owstimer and Central Administration must run as the Farm Admin account.
    – user6024
    Commented Mar 3, 2016 at 18:20
  • Interesting - I was told explicitly to create a separate service account for the timer service. :-( Okay, if we put that and Central Admin aside, it seems I'm most of the way there, then, right? Any idea about point 3 above? (The ones that show as different accounts under Central Admin as they do under IIS?)
    – teleute00
    Commented Mar 3, 2016 at 18:23
  • Your separate service account is the farm admin. STS and SharePoint Web Services System also run as the farm admin account. Again, normal and expected. Cannot change this.
    – user6024
    Commented Mar 3, 2016 at 18:27
  • So confused as to why it's showing me that a change to a different service acct worked in the GUI, then - if I look under Central Admin it shows me that SPWebAppSvc is the account for Web Services System. It's only IIS that still shows it as FarmAdmin. Maybe a bug in 2016?
    – teleute00
    Commented Mar 3, 2016 at 18:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.