0

I have 2 accounts setup form my SharePoint Server (SPAdmin and SPServices). SPAdmin is in the local server's administration group and is the Farm Admin. I am running SharePoint 2013 Enterprise.

In the /_admin/FarmCredentialManagement.aspx page I have the following :

SPAdmin user is in the the following components:

  • Farm Account

SPServices user is in the following components:

  • Windows Service - Distributed Cache
  • Windows Service - Microsoft SharePoint Foundation Sandboxed Code Service
  • Windows Service - Search Host Controller Service
  • Windows Service - SharePoint Server Search
  • Windows Service - User Profile Synchronization Service
  • Web Application Pool - SharePoint - 80
  • Security Token Service Application (Security Token Service Application)
  • Service Application Pool - SharePoint Web Services Default
  • Service Application Pool - SharePoint Web Services System

Local System user is in the the following components:

  • Windows Service - Claims to Windows Token Service
  • Windows Service - Document Conversions Launcher Service
  • Windows Service - Document Conversions Load Balancer Service
  • Service Application Pool - SharePoint Web Services Default
  • Service Application Pool - SharePoint Web Services System

I am getting the following error in the Health Analyzer.

Accounts used by application pools or service identities are in the local machine Administrators group.

Severity
2 - Warning
Category
Security

Explanation
Using highly-privileged accounts as application pool or as service identities poses a security risk to the farm, and could allow malicious code to execute.  
The following services are currently running as accounts in the machine

Administrators group: 

SharePoint Central Administration v4 (Application Pool)
SPTimerV4(Windows Service)
0

You're good to go. Simply disable the Health Analyzer rule or ignore the warning. The HA rule isn't very smart in that it doesn't ignore services that should be ignored (CA and SPTimerV4).

0

The Admin account shouldn't be part of the local admins group on the server in the long-term. For SharePoint 2013 membership of the local admins group is required for the configuration of the User Profile Service Application synchronisation service, but once that is complete, you can remove the account from the local admins group.

See http://www.toddklindt.com and https://technet.microsoft.com for information on suggested service accounts and the permissions that they require.

  • Which are all the SharePoint Admin accounts? The only component that is a local admin right now is the Timer Service. I tried changing to SPServices (which is not an admin), but the Timer jobs wouldn't run. – Rick Sep 16 '16 at 17:12
  • The SPAdmin account is the one that should be removed from the server's local administrators group. – Andy Dawson Sep 16 '16 at 18:18
  • I removed the account and reanalyzed and am still getting the warning on the Centra Administration page and in the Event Viewer. – Rick Sep 16 '16 at 18:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.