2

I created sp_farm accont which i set as database access account during psconfig during SP13 installation. Once i logged to CA with sp_admin account and when i checked farm administrators group i see only sp_admin there and builtin/administrators which is fine.

If sp_farm acc is not the farm administrator and i don't use it to login to ca, what rights (beside sql roles) does it have and what should it be used for?

  • Also, when i open CA, i get the HA warning: "Accounts used by application pools or service identities are in the local machine Administrators group." Under Service Accounts i see all services are running under sp_admin acc which i used to install SP and which is local admin. sp_admin is also listed as farm account under Service Accounts. How come sp_farm is not used for anything? I could really use some explanation and help. . – Ixinho Oct 11 '16 at 22:20
1

I would like to inform you that the SP_Farm is the domain user that you used to configure your SharePoint farm, that must have DB creator , security admin as SQL role on the SQL Server level.

And as you said if you have used it during configuring SharePoint so by default,

  • it is a member of farm administrator group that can't be removed from it.
  • it is the account that runs SharePoint timer service.
  • it is the account that runs the Central Administration application pool

Regarding : at health analyzer you get the

Accounts used by application pools or service identities are in the local machine Administrators group

this issue occurs because of the farm account is a member of Administrators group on the local computer, meanwhile, it runs Central Administration application pool , SharePoint timer service.

And to avoid this health analyzer warning , you should remove the farm account from Administrators group on the local computer and make sure that any service account or application pool account is not a member of Administrators group on the local computer.

Also, check the details steps at Accounts used by application pools or service identities are in the local machine Administrators group within Health Analyzer Issues in SharePoint Server

| improve this answer | |
  • Hm, there is definitely some misunderstanding here. – Ixinho Oct 12 '16 at 7:43
  • Sorry, accidentally pressed Enter. As i said, it looks like something's missing here. I have created two accounts: sp_admin and sp_farm. I used sp_admin to login to servers where i installed SP13. I created a sql login for sp_admin and assigned dbcreator and securityadmin. Once SP was installed, during psconfig i entered sp_farm as database access account. But now, in the group farm administrators, there is only sp_admin acc, not sp_farm. My SharePoint timer service runs under sp_admin. Other services as well. Did i do something wrong ? – Ixinho Oct 12 '16 at 7:46
  • And only sp_admin is local admin on all sp servers, never added sp_farm as local admin . . – Ixinho Oct 12 '16 at 7:47
1

I found what the problem was. For some unknown reason, sp_farm account was gone from AD, so i redeployed whole Lab with 100% sp_farm account being present in AD and it worked fine. Sp_farm is now in farm administrator group and is running services. However one thing is really bugging me. Microsoft allows to specify database access account which doesn't even exist and it won't throw any error, it will let you go further in psconfig? Really, really stupid. One more question, when i login to CA with sp_admin i can access everything. When i login with sp_farm i can't open "Configure services". It says, this hasn't been shared with you. How come?

| improve this answer | |
0

Sp farm account(farm admin) is most important and critical account for sharepoint deployment. This account is responsible to run the sharepoint services (sharepoint time service), app pool of central admin.

As per requirement this account should have dbo creator and security admin, also local admin on the local sharepoint server.

I have sp farm account in all sharepoint server even i am not using this account to login central admin.

| improve this answer | |
  • It looks like something's missing here. I have created two accounts: sp_admin and sp_farm. I used sp_admin to login to servers where i installed SP13. I created a sql login for sp_admin and assigned dbcreator and securityadmin. Once SP was installed, during psconfig i entered sp_farm as database access account. But now, in the group farm administrators, there is only sp_admin acc, not sp_farm. My SharePoint timer service runs under sp_admin. Other services as well. Did i do something wrong ? – Ixinho Oct 12 '16 at 7:46
  • And only sp_admin is local admin on all sp servers, never added sp_farm as local admin . . – Ixinho Oct 12 '16 at 7:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.