I am installing SharePoint on my local machine. What accounts are needed to install SharePoint?

It seems ubiquitous that you need the following accounts.

  • SP_Admin (Account you install SP with)
  • SP_Farm (Accounts used to access the DB)

What other accounts are needed?



* SQL Server – dbcreator and securityadmin roles
* Local administrator on SharePoint servers

* This account is used to perform the initial install and configuration of SharePoint.
* Technically not a service account


* SQL Server – dbecreator and securityadmin roles
* Allow log on locally
* Log on as a service

* SharePoint farm account specified in SharePoint Configuration Wizard
* This account also will have local administrator privileges when provisioning User Profile Synchronization


* Log on as a batch job

* Application pool account for main SharePoint web application
* Could also just be called sp_AppPool or spAppPool + <PortNumber>


* Log on as a batch job

* Application pool account for web application hosting service applications


* Log on as a batch job

* Application pool account for My Sites web application


* Replicating directory changes

* Account used to synchronize user profiles from Active Directory


* Log on as a service

* Account used for running Search Service


* Full Read on each web application

* This account is used by search when crawling
* This account must not have local administrator permission or SharePoint administrator permissions


* SQL Server – dbcreator role
* Log on as a service
* Allow log on locally
* This account is used to run the FAST Search for SharePoint services

http://www.dotnetmafia.com/blogs/dotnettipoftheday/archive/2011/05/23/corey-s-guide-to-sharepoint-service-accounts.aspx for more information


Microsoft recomends for security reasons to run every SP-Service with an seperate account. So if you install the SP Server 2010 you get quick up to 10 + accounts.

We have set up our DEV-Environment with only 3 admin accounts, like you proposed SP-Admin (SP installation), SP-SQL (SQL-DB access) and SP-Service (running all services via this account).


For local standalone installation of SharePoint 2010 you don't need extra accounts. Your current account with admin rights will do.

By default SharePoint will run under local service accounts.

To set up SharepPoint 2010 localy you can follow steps provided here:

If you want to use SQL server 2008 instead of default SQL Express you need to do some extra work explained here:

And you can always add some additional accounts in future if you really need them:


You can use your own account if you are installing SharePoint on your local machine. Same account can be SP_Admin and SP_Farm both. The account which is used for installing SharePoint must have access in SharePoint_Config DB and WSS_Content DB in SQL Server.


SP_Admin and SP_Farm are the least you need. Typically this is what I do:

1) Usually there is a seperate account for install such as SP_Install (maybe that's what you meant by SP Admin), even though you could use a highly privileged ordinary user account for this, that account will be eternally stuck in the SharePoint farm. When you get that promotion to VP and don't want anything more to do with SharePoint Admin, you'll thank yourself for creating that account then, so you could just turn over the SP_Install account to the next guy in charge of that farm. :-)

2) Search gets it's own access account for crawling, why? Because you may want to fine grain what gets searched and what doesn't...

3) Running Kerberos? Setup an account for each web application you plan on running, makes it easy to configure SPN's later...NTLM only people need not apply (just one service account for all web apps is fine) but it might be good practice if you think you'll need to go Kerberos someday. Look up SPN's and their purpose on your own.

4) Service apps typically get a single account dedicated to all of them. Some people go all out and do one service app account per service app. Can make things easier to spot in the audit trails this way.

5) User Profile Sync needs special privileges above an ordinary service account, but it doesn't need full admin access, usually it's advisable for security that you create a seperate account for user profile sync.

This is just the tip of the iceberg. FAST has its own requirements, other third party apps might too, etc...


I think the links below may help you:

TechNet: Plan for administrative and service accounts (SharePoint Server 2010)

Sharee’s Blog: Necessary SharePoint Service Accounts

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.