least-privileged administration in SharePoint 2013

Question

In a SharePoint 2013 what is it means least-privileged administration and why it needed ? and what is the difference between Service Accounts Best Practices

Answer 1

The concept of least-privileged administration is to assign users the minimum permissions that are required for users to complete authorized tasks. The goal of least-privileged administration is to configure and help maintain secure control of an environment. The result is that each account under which a service runs is granted access to only the resources that are absolutely necessary.

Read More here: Plan for least-privileged administration in SharePoint 2013

Simple example, You dont want all service account as Domain Admin or in the Local Admin groups, because this gives them full control on Domain or Local server which is security risk.

As a best Practices, MSFT recommended different service accounts for different tasks. The main concept behind this separation of Duties. This practice, improves stability and give you more control and less security risk.

• I.e. if you use single account for everything then if that account gets locked / expired then the whole farm will go down. So multiple accounts will help to avoid such incidents.
• Account with Domain admin rights, can do whatever you want on server and in share point, which can open the hole for person to get the account and grab all the information from share point. Just a thouht.

Also read this : https://absolute-sharepoint.com/2013/01/sharepoint-2013-service-accounts-best-practices-explained.html