0

I am trying to get a sharepoint 2016 preview environment up and running for evaluation purposes. I just happen to have never installed a sharepoint farm before so this is the environment I am learning with. Additionally I am using Azure to host a virtual network with VMs.

I have gotten basically everything provisioned and installed seemingly correctly up to the initial farm configuration point. After that seems to be installing a web application in sharepoint - this is where I'm having trouble. I get an error when I do so (and I don't know much about this error either).

My thought is I have messed up the accounts in some way. I've read all about how you need different service accounts, however different tutorials will explain this differently and since I don't really have any AD administration experience I am totally in the dark on how to properly setup these accounts. Specifically for sharepoint I am also unsure when to use each one (the tutorials sometimes seem to forget to tell you when to log out/log in as a different account).

Anyway here are the tutorials I am using:

Set up virtual network in Azure and get a server up with AD:http://www.learningsharepoint.com/2015/08/27/step-by-step-create-sharepoint-2016-farm-with-azure-virtual-machines/

Provision a SQL server: http://www.learningsharepoint.com/2015/08/27/provision-sql-server-vm-for-sharepoint-2016-install-in-azure/

Install SP: http://www.learningsharepoint.com/2015/09/01/sharepoint-server-2016-it-preview-vm-is-now-on-azure/

Could anyone shed any light on the proper way the necessary accounts should be setup and used?

Also, I am doing a "single server farm" install.

  • it is the same as for sharepoint 2013, but i am more interested about what you did and what error u get. – Waqas Sarwar MVP Oct 14 '15 at 18:09
  • yup, let me try to rerun the webapp creation and get the error posted on here. sorry would have included in question but i was just having some problems getting my virt back up to try and get the error again – JzInqXc9Dg Oct 14 '15 at 18:18
1

There's no technical restrictions to use only one single account. You may install with and use a single account to configure SharePoint. All services/app pools will then run with that same identity. This is even what some developpers do when they setup their dev machine. Using multiple accounts is mainly a matter of security/maintenance/robustness.

I usally simplify accounts management as this:

  • "SPAdmin": the account you log on with while installing SharePoint. This account will be the account you'll later use to administrate SharePoint (hence the name). That's the only account that initially needs admin rights on SQL Server ("SPAdmin" is used by the setup to create the config DB).
  • "SPFarm": the account used by SharePoint to run core services (Windows services like SPTimer, and also the central administration pool). You enter this account in the setup wizard.
  • "SPServices": used to configure most application services (search, BCS, ...). You enter it in the CA, at first launch, when prompted to create application services in the configuration wizard.
  • "SPContent": used for your first Web app. As the configuration wizard creates the first Web app/app pool with "SPServices", you can delete it and recreate it by using "SPServices".

Later on, you could use other accounts for search configuration, etc. but 4 accounts is already a piece of work to administrate... My customers are already surprised when I explain them they have to create at least 4 service accounts in the AD...

| improve this answer | |
  • i generally understand these different accounts need to exist.... but why exactly? is it a best practice? is it actually required? your answer (and thank you for the answer btw...) leaves me with the same question i have reading other posts about this, which is: what makes these accounts (other than why they are used) actually different from each other? - that is, can you please spell out specifically the permissions involved for each one? and are these permissions only defined in SQL server? or something in AD manager? both? – JzInqXc9Dg Oct 14 '15 at 18:25
  • There's no technical restrictions to use only one single account. You may install with and use a single account to configure SharePoint. All services/app pools will then run with that same identity. This is even what some developpers do when they setup their dev machine. Using multiple accounts is mainly a matter of security/maintenance. Updated my answer with this. – Evariste Oct 14 '15 at 19:46
0

typical reason behind all these service accounts are to avoid major outage and separation of duties.

If you running the farm with single account then you are taking big risk, i.e if account is locked then SharePoint will goes down completely.

so if you running the SharePoint with different account as per MSFT & best practices recommended then you will lower this risk. Like, one account for the installation( which required high permissions) which will do all the installation and maintenance and daily work(powershell).

One account for the Farm admin which again required high end permission on sql and sharepoint server, No need to touch this account.

You can use one account for all webapps app pool or one for each webapp

same for the services applications.

you need accounts for super user and super reader account.

Here is guide from MSFT: https://technet.microsoft.com/en-us/library/cc263445.aspx?f=255&MSPPError=-2147217396

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.