Confused about accounts. How do I set them up correctly and what do I need (and when?) for install?

Question

I am trying to get a sharepoint 2016 preview environment up and running for evaluation purposes. I just happen to have never installed a sharepoint farm before so this is the environment I am learning with. Additionally I am using Azure to host a virtual network with VMs.

I have gotten basically everything provisioned and installed seemingly correctly up to the initial farm configuration point. After that seems to be installing a web application in sharepoint - this is where I'm having trouble. I get an error when I do so (and I don't know much about this error either).

My thought is I have messed up the accounts in some way. I've read all about how you need different service accounts, however different tutorials will explain this differently and since I don't really have any AD administration experience I am totally in the dark on how to properly setup these accounts. Specifically for sharepoint I am also unsure when to use each one (the tutorials sometimes seem to forget to tell you when to log out/log in as a different account).

Anyway here are the tutorials I am using:

Set up virtual network in Azure and get a server up with AD:http://www.learningsharepoint.com/2015/08/27/step-by-step-create-sharepoint-2016-farm-with-azure-virtual-machines/

Provision a SQL server: http://www.learningsharepoint.com/2015/08/27/provision-sql-server-vm-for-sharepoint-2016-install-in-azure/

Install SP: http://www.learningsharepoint.com/2015/09/01/sharepoint-server-2016-it-preview-vm-is-now-on-azure/

Could anyone shed any light on the proper way the necessary accounts should be setup and used?

Also, I am doing a "single server farm" install.

Answer 1

There's no technical restrictions to use only one single account. You may install with and use a single account to configure SharePoint. All services/app pools will then run with that same identity. This is even what some developpers do when they setup their dev machine. Using multiple accounts is mainly a matter of security/maintenance/robustness.

I usally simplify accounts management as this:

• "SPAdmin": the account you log on with while installing SharePoint. This account will be the account you'll later use to administrate SharePoint (hence the name). That's the only account that initially needs admin rights on SQL Server ("SPAdmin" is used by the setup to create the config DB).
• "SPFarm": the account used by SharePoint to run core services (Windows services like SPTimer, and also the central administration pool). You enter this account in the setup wizard.
• "SPServices": used to configure most application services (search, BCS, ...). You enter it in the CA, at first launch, when prompted to create application services in the configuration wizard.
• "SPContent": used for your first Web app. As the configuration wizard creates the first Web app/app pool with "SPServices", you can delete it and recreate it by using "SPServices".

Later on, you could use other accounts for search configuration, etc. but 4 accounts is already a piece of work to administrate... My customers are already surprised when I explain them they have to create at least 4 service accounts in the AD...

Answer 2

typical reason behind all these service accounts are to avoid major outage and separation of duties.

If you running the farm with single account then you are taking big risk, i.e if account is locked then SharePoint will goes down completely.

so if you running the SharePoint with different account as per MSFT & best practices recommended then you will lower this risk. Like, one account for the installation( which required high permissions) which will do all the installation and maintenance and daily work(powershell).

One account for the Farm admin which again required high end permission on sql and sharepoint server, No need to touch this account.

You can use one account for all webapps app pool or one for each webapp

same for the services applications.

you need accounts for super user and super reader account.

Here is guide from MSFT: https://technet.microsoft.com/en-us/library/cc263445.aspx?f=255&MSPPError=-2147217396