Three questions on a theme...

Which accounts should be managed accounts?

Or perhaps to put it another way, which services / things are best to have as managed accounts?

Or perhaps the opposite question: Are there any accounts that are best not set up as managed accounts?

1 Answer 1


It is a best practice to create a specific service account per Service Application, so that the farm service account is only used for this specific purpose (health monitor will warn you if it is used for other services). With few exceptions these can each be made a managed account.

Also create a service account per application pool, as this is a natural security boundary in your farm. I usually create one for web services and one for web applications. If I run both intranet and extranet on the same farm, I will create a web application pool for each and give them each a unique account.

Some service accounts cannot be made managed accounts. This includes the User Profile Synchronization account, the portal super reader and super user account (both used for caching).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.