We have a 2010 SharePoint farm that we took over from staff that left. We are currently going through a compliance audit of SharePoint accounts that are in the local administrators group and the main question is, do these accounts still need to be in the administrators group or is it safe to remove them? Some of these accounts do show up in the Central Admin under Monitoring\configure managed accounts...however, they have no SP components listed with them....

  1. ProdInstall - it's assumed this account was used as the primary SP installation account and it shows up in a few places in the registry but no services or IIS pools are bound to it and no components listed in Central Admin.

  2. ProdSuperReader - no clue what this account is for and it shows no components in Central Admin nor does it have any services or app pools bound to it. Like the account above, it does have a few references in the registry or one or more farm machines.

Bottom line is it best practice or advisable to remove these accounts from the local administrators group on the farm machines? Yes I know testing would be a must be would like to hear from someone who has experience with this scenario. I am sure I'm not the only one who has a security group who tries to minimize accounts in the local admin group on production servers.

Thanks for any light you can shed on this!

1 Answer 1


The only accounts that must remain as local administrators in a SharePoint farm are the actual SharePoint admins, the Farm Admin only on the server running the User Profile Sync Service, and finally the Claims to Windows Token service account. No other account needs to be a local admin. And yes, you should limit local admin rights.

  • Hi @Trevor I think adding the farm account to local Administrator group is required only to start the User Profile Synchronization Service. Once the UPS is started you should remove it from local Admin Group to avoid this health analyzer secutiy warning: "Accounts used by application pools or service identities are in the local machine Administrators group" Please correct to me if I am wrong :) !! Commented Mar 14, 2017 at 18:34
  • The problem is in order to release the token, it requires the account log out of the system. Which then means you can't start UPSS...
    – user6024
    Commented Mar 14, 2017 at 18:42
  • I am sorry, I don't got it, Should you elaborate more ? What I mean is to start UPSS you must add the farm account to local Admin Group and that requires to restart Timer Service, Now the UPPS is started, so you should remove the farm account from local Admin Group then restart Timer Service again that will not effect on the UPPS status where it is started! Right? Commented Mar 14, 2017 at 18:50
  • You would have to restart the FIM services to drop the admin token. To start them would require the admin token.
    – user6024
    Commented Mar 14, 2017 at 18:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.