2

We have a 2010 SharePoint farm that we took over from staff that left. We are currently going through a compliance audit of SharePoint accounts that are in the local administrators group and the main question is, do these accounts still need to be in the administrators group or is it safe to remove them? Some of these accounts do show up in the Central Admin under Monitoring\configure managed accounts...however, they have no SP components listed with them....

  1. ProdInstall - it's assumed this account was used as the primary SP installation account and it shows up in a few places in the registry but no services or IIS pools are bound to it and no components listed in Central Admin.

  2. ProdSuperReader - no clue what this account is for and it shows no components in Central Admin nor does it have any services or app pools bound to it. Like the account above, it does have a few references in the registry or one or more farm machines.

Bottom line is it best practice or advisable to remove these accounts from the local administrators group on the farm machines? Yes I know testing would be a must be would like to hear from someone who has experience with this scenario. I am sure I'm not the only one who has a security group who tries to minimize accounts in the local admin group on production servers.

Thanks for any light you can shed on this!

2

The only accounts that must remain as local administrators in a SharePoint farm are the actual SharePoint admins, the Farm Admin only on the server running the User Profile Sync Service, and finally the Claims to Windows Token service account. No other account needs to be a local admin. And yes, you should limit local admin rights.

  • Hi @Trevor I think adding the farm account to local Administrator group is required only to start the User Profile Synchronization Service. Once the UPS is started you should remove it from local Admin Group to avoid this health analyzer secutiy warning: "Accounts used by application pools or service identities are in the local machine Administrators group" Please correct to me if I am wrong :) !! – Mohamed El-Qassas MVP Mar 14 '17 at 18:34
  • The problem is in order to release the token, it requires the account log out of the system. Which then means you can't start UPSS... – Trevor Seward Mar 14 '17 at 18:42
  • I am sorry, I don't got it, Should you elaborate more ? What I mean is to start UPSS you must add the farm account to local Admin Group and that requires to restart Timer Service, Now the UPPS is started, so you should remove the farm account from local Admin Group then restart Timer Service again that will not effect on the UPPS status where it is started! Right? – Mohamed El-Qassas MVP Mar 14 '17 at 18:50
  • You would have to restart the FIM services to drop the admin token. To start them would require the admin token. – Trevor Seward Mar 14 '17 at 18:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.