1

I've got this error message on my SharePoint, I don't know how to resolve.

Domaine\SQLadmin, the account used for the SharePoint timer service and the central administration site, is highly privileged and should not be used for any other services on any machines in the server farm.  The following services were found to use this account:
SPUserCodeV4(Windows Service)
Service de cache distribué(Windows Service)
SPSearchHostController(Windows Service)

If you have any idea on how to resolve it, please help me. Thank you.

Improve this question

1 Answer 1

Reset to default
2

From security perspective, the account (farm account) used for the SharePoint timer service and the central administration site, is highly privileged and should not be used for any other services on any machines in the server farm.

So to overcome this issue you should do the following:

  • List the affected services, in your case
    • SPUserCodeV4(Windows Service) - SharePoint User Code Host
    • Service de cache distribué(Windows Service) - AppFabric Caching Service
    • SPSearchHostController(Windows Service) - SharePoint Search Host Controller

  • In AD, Create a domain user to run the services that are already running with the farm account.

  • Add the service accounts to the managed account in Central Administration. -Central Administration > Security > Configure Managed Accounts.

  • Now follow the mentioned steps at Distributed Cache Service does not support this operation from Central Administration. Please use Sharepoint Powershell commandlets to can change the service account of Distributed cache.

  • To change the service account of SPSearchHostController, open CentralAdministration > Security > Configure Service Account > Select SharePoint Search Host Controller > Provide the new service account.

Note:

As discussed in comments with @Trevor you should Do not change Search Host Controller that needs to run as the farm admin in order to start Search Service in the event of a failure.

  • Regarding SPUserCodeV4(Windows Service), it's not listed on Configure Service Account so to change it, do the following:

  • Open Services by clicking on windows button + R then type services.msc.

  • You should be aware of the display name for each affected service as the following

Services

Service                         Display Name

SPUserCodeV4(Windows Service)   SharePoint User Code Host
  • Search with your Display account in the services list.

  • Right click on the service name > properties> logon tab > browse and select your service account.

  • Go back to the Central Administration > Monitoring > Review problems and solutions.

  • Click on the error "The server farm account should not be used for other services" >
  • From ribbon > Select the Reanalyze Now.
  • Wait amoment, and go back to Review problems and solutions > the issue should not be now listed.
Improve this answer
5
  • 3
    Do not change Search Host Controller. For the other services, use one service account for all Service Applications (Instances). There's no reason to use multiple and will just waste memory/slow down startup time.
    – user6024
    Feb 19, 2017 at 15:06
  • Thanks @TrevorSeward 1. Regarding Do not change Search Host Controller should you tell me why? it's already listed in the health analyzer warning! 2. Regarding use one service account for all Service Applications? Are you mean I can create one service account to run UPS and Search ...etc.? I think from the security perspective it's preferred to use an independent service account for each service application also at technet.microsoft.com/en-us/library/cc263445.aspx it's mentioned a service account for each popular application service.
    – Mohamed El-Qassas MVP ♦
    Feb 19, 2017 at 21:32
  • 4
    No, from a security perspective there's zero advantage to using multiple (SPO, for example, uses a single account for all SIs). Host Controller needs to run as the farm admin in order to start Search Service in the event of a failure.
    – user6024
    Feb 19, 2017 at 21:33
  • Why Host Controller is listed in this case ? and could you please tell me, can I create one service account to run UPS and search?
    – Mohamed El-Qassas MVP ♦
    Feb 19, 2017 at 21:35
  • 3
    Because the health rule has no intelligence. It is one of those you will eventually just disable, similar to the 5x RAM free disk space one. Health analyzer rules aren't hard and fast "best practice". They're inflexible and Microsoft isn't updating them as the product improves; e.g. it will still tell you that 200GB is the limit for content databases, which is far from the truth.
    – user6024
    Feb 19, 2017 at 21:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.