0

So I did an install of SP2016 as my farmadmin account, and now it's my understanding that it's best practice to change the services to run under a variety of service accounts. For this go, I'm trying to have the following, based on a number of sites/guides I've read:

SPServicesSvc (General service acct to run services) SPWebAppSvc (Sometimes seen this called SP_Pool - to run Web Apps in IIS) SPSearchSvc (To run search services) SPTimerSvc (To run timer service) SPUserProfileSvc (To run User Profile service)

This is all in addition to the Farm Admin account.

In Central Admin, under Security -> Manage Service Accounts I was able to:

  • change the default to SPServicesSvc, and any other general services that were originally FarmAdmin from the install.
  • change the search services to SearchSvc.
  • change the Sharepoint - 80 Web App Pool to SPWebAppSvc.

However, this is where it starts to fall apart a bit:

  • The Central Admin app pool isn't there, the way Sharepoint - 80 is, so I'm not sure the best way to change that. I know that just changing it in IIS isn't sufficient, but not sure what is. Nor do I understand why it's missing in the GUI.

  • The Timer service also isn't there. For this case, I read somewhere it's okay to change this in the Windows Services screen directly. Does that seem right?

  • A couple of services under Security -> Manage Service accounts allowed me to change them, but when I look under IIS I still see those listed as the Farm Admin account (even though others, like Sharepoint - 80, do in fact reflect the GUI changes under IIS). These include "Service Application Pool - SharePoint Web Services System" and "Service Application Pool - SecurityTokenServiceApplicationPool". I've tried restarting the services, restarting IIS, rebooting the whole machine...nothing. They remain different in each place.

The User Profile Service seems immensely complicated, so I haven't even tried that one yet...

So the questions I have are - 1. is this even an okay plan in the first place? Most of what I've read seem to highly encourage changing these accounts, but is varied as to how many accounts need to be made/involved. And 2. if this is generally okay, how do I overcome the issues in part two above? (The ones that I haven't been able to change.)

Thank you!

1

Central Administration and the Timer Service are run by the Farm Administrator account. You do not need to change these, but you can certainly change what service account runs them (it then becomes your Farm Admin account):

stsadm –o updatefarmcredentials –userlogin DOMAIN\username –password passWord

I generally run Search under the same service account as what your "SPServicesSvc" is fulfilling. Not much need to separate it out.

The following services must run as the Farm Administrator:

  • Central Administration
  • Timer Service
  • Security Token Service Application Pool
  • SharePoint Web Services System
  • I don't want to change the Farm Admin account, though - it's a custom account made for the purpose, and it's fine. I'd just been advised to break the web front-end and the timer services out onto different accounts from the admin, for security purposes. You're saying you don't feel there's an advantage there? – teleute00 Mar 3 '16 at 18:19
  • You're correct in stating that the Web Application(s) and Services (with a few exceptions) should be broken out into two (preferably) service accounts. That said, owstimer and Central Administration must run as the Farm Admin account. – Trevor Seward Mar 3 '16 at 18:20
  • Interesting - I was told explicitly to create a separate service account for the timer service. :-( Okay, if we put that and Central Admin aside, it seems I'm most of the way there, then, right? Any idea about point 3 above? (The ones that show as different accounts under Central Admin as they do under IIS?) – teleute00 Mar 3 '16 at 18:23
  • Your separate service account is the farm admin. STS and SharePoint Web Services System also run as the farm admin account. Again, normal and expected. Cannot change this. – Trevor Seward Mar 3 '16 at 18:27
  • So confused as to why it's showing me that a change to a different service acct worked in the GUI, then - if I look under Central Admin it shows me that SPWebAppSvc is the account for Web Services System. It's only IIS that still shows it as FarmAdmin. Maybe a bug in 2016? – teleute00 Mar 3 '16 at 18:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.