Do I need an Install account and an Admin account? Why?

Question

I have read various places that it's best practice to never use your Install account for anything except installation and applying patches. I've also read you should not use your farm account or any other service account to log into the server or do any admin tasks. Do people actually switch to a separate admin account? It seems like "Do as I say, not as I do" because:

Most tutorials leave out details such as what point during the install/configuration I am supposed to switch from spInstall to spAdmin.

I've read a lot of "What accounts do I need" questions on forums and TechNet. The accepted answer on this question doesn't even list an admin account as required.

After reading Todd Klindt's writeup on how to stop using spFarm, I question if it's worth the effort.

What permissions is the Install account going to have that the Admin account won't have or need?

UPDATE: Can anyone provide documentation (preferably from MS) explaining why I shouldn't use the install account for administration?

Answer 1

As almost always with SharePoint the answer is "It depends".

Why should I have a separate Install account?
The main purpose of a separate Install account is to be sure you have an account which is owner of all the installed files and therefore always have the rights to update these. So at least you shouldn't use a personal account for the installation as you may not be there at some upgrade.

Why should I have a separate admin account?
Here are some reasons:

1. You should not use your own account as this would mean that when you're just browsing the intranet (or whatever your SharePoint is used for) you have too many rights and may do something bad by accident.
2. You should have a normal account so you normally see the SharePoint environment like everybody else, that'll make it easier for you to understand the users.
3. You should not use the farm account as all admin changes are then just logged as having been performed by "System". It's a lot easier to troubleshoot (or blame) when you can see who performed the change.

Why don't everybody then always do it?
Well it's more work and most people are lazy.

I'm lazy too what should I do then?
I'd recommend that you do the install/patching using an Install account, that way everbody allways knows which account to use for that.
If you're a small installation I'd probably just use spFarm for doing admin updates, but DON'T run as spFarm as your standard login.

Answer 2

Being in the lazy camp, when initially installing sharepoint you need local admin, technically a farm account does not (according to documentation)

The one exception is that the user profile service Is going to have problems initially starting during a reboot of the server. So from time to time you'll find that you need to go in, give local admin, do what you need to, and reduce privileges.

You can also get unintended issues, such as this one from the 2007 days.... http://iedaddy.com/2007/12/the-evaluation-version-of-microsoft-office-sharepoint-server-2007-for-this-server-has-expired/

You will also from time to time get errors in your event viewer for things sharepoint farm account tries to access, but can't. One item that comes to mind is the msiinstaller, whic for some strange reason sharepoint uses to check versions on the server with.

So if you don't mind your farm account having local admin and use it for the install and patching, generally that's the way to go for simplicity sake. If you take away local admin you'll get a handful of com+ local activation errors and such in your event logs which can be ignored, although I usually go in and tweak farm permissions so I can take away local admin and not fill my log with errors.