0

I have 2 accounts setup form my SharePoint Server (SPAdmin and SPServices). SPAdmin is in the local server's administration group and is the Farm Admin. I am running SharePoint 2013 Enterprise.

In the /_admin/FarmCredentialManagement.aspx page I have the following :

SPAdmin user is in the the following components:

  • Farm Account

SPServices user is in the following components:

  • Windows Service - Distributed Cache
  • Windows Service - Microsoft SharePoint Foundation Sandboxed Code Service
  • Windows Service - Search Host Controller Service
  • Windows Service - SharePoint Server Search
  • Windows Service - User Profile Synchronization Service
  • Web Application Pool - SharePoint - 80
  • Security Token Service Application (Security Token Service Application)
  • Service Application Pool - SharePoint Web Services Default
  • Service Application Pool - SharePoint Web Services System

Local System user is in the the following components:

  • Windows Service - Claims to Windows Token Service
  • Windows Service - Document Conversions Launcher Service
  • Windows Service - Document Conversions Load Balancer Service
  • Service Application Pool - SharePoint Web Services Default
  • Service Application Pool - SharePoint Web Services System

I am getting the following error in the Health Analyzer.

Accounts used by application pools or service identities are in the local machine Administrators group.

Severity
2 - Warning
Category
Security

Explanation
Using highly-privileged accounts as application pool or as service identities poses a security risk to the farm, and could allow malicious code to execute.  
The following services are currently running as accounts in the machine

Administrators group: 

SharePoint Central Administration v4 (Application Pool)
SPTimerV4(Windows Service)
  • Using just 1 service account in SharePoint that handles everything is a TERRIBLE idea. The links in andy dawson's answer should really be read and understood. – Nullldata Aug 1 at 10:53
1

The Admin account shouldn't be part of the local admins group on the server in the long-term. For SharePoint 2013 membership of the local admins group is required for the configuration of the User Profile Service Application synchronisation service, but once that is complete, you can remove the account from the local admins group.

See http://www.toddklindt.com and https://technet.microsoft.com for information on suggested service accounts and the permissions that they require.

  • Which are all the SharePoint Admin accounts? The only component that is a local admin right now is the Timer Service. I tried changing to SPServices (which is not an admin), but the Timer jobs wouldn't run. – Rick Sep 16 '16 at 17:12
  • The SPAdmin account is the one that should be removed from the server's local administrators group. – Andy Dawson Sep 16 '16 at 18:18
  • I removed the account and reanalyzed and am still getting the warning on the Centra Administration page and in the Event Viewer. – Rick Sep 16 '16 at 18:55
-1

You're good to go. Simply disable the Health Analyzer rule or ignore the warning. The HA rule isn't very smart in that it doesn't ignore services that should be ignored (CA and SPTimerV4).

  • "You're good to go" seems like pretty dangerous advice to be giving on a farm with 1 service account. While this configuration is workable, it is a pretty dire setup. People searching the internet for this Health Analyzer rule may come across this answer and assume that this is the correct way to deal with Service Accounts on SharePoint. – Nullldata Aug 1 at 10:51
  • You need to re-read the OPs post. First, he's using 2 (not ideal, surely) but the Farm Admin must be in the Local Admins group on the server running UPSS, so the advice I provided is correct in context. If this was a 2016 or 2019 farm, the answer would be different. – Trevor Seward Aug 1 at 15:03
  • The Farm account only needs to be in the local admins while provisioning UPSS, as far as I was aware. I believe it doesn't need to be in that group after the UPSS has been provisioned. Yes the Health Analyzer rule is a bit misleading, however I wouldn't personally recommend removing it. I'd advise people to be aware of it, and that the advice given in it is not always useful. – Nullldata Aug 3 at 8:49
  • Since you must log off in order to revoke the administrator token, and the provisioning happens during service startup, removing the farm account from the Local Admins group doesn't serve a purpose as long as you need to continue to run UPSS. The account will always have a administrator token. – Trevor Seward Aug 3 at 16:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.