User Profile Service setup accounts

Question

I have a problem with setting up the service account to run the User Profile sync Service. I have three accounts for that:

• Sp_Admin: managed account, local admin on all sp servers
• SP_farm: farm account,farm admin,managed account, local admin on all sp servers
• sp_services: domain account, managed account

I provisioned the service and the pool application with Sp_farm account, afterwards I changed the Pool account from (configure service accounts) to Sp_services and the service stopped working.

Which privileges should the accounts have? I am totally confused with them :(

Answer 1

You need to make sure the farm account being used has local admin rights on the server during setup and have rights to log on locally.

You can read more about it here:

Plan for profile synchronization (SharePoint Server 2010)

The farm account

The User Profile Synchronization service runs under the farm account. The farm account requires specific permissions in order to configure profile synchronization. A person with administrator rights on the synchronization server can grant these permissions.

• The account must be a member of the Administrators group on the synchronization server. You can remove this permission after you have configured the User Profile Synchronization service.

• The account must be able to log on locally to the synchronization server.

Note: The farm account is not the same as the farm administrator account. To determine the farm account, from Central Administration, click Configure service accounts, and then click Farm account.

Answer 2

When you start the User Profile Service from Services on Server it should have the Farm account listed and unchangeable. You should not change this to another account or the UPS will stop working. The synchronization service can run as another account provided it meets the provisioning and running requirements and has the proper permissions on the AD containers you are synchronizing with.