1

Can some one share information on,

1- What account should be used to run SharePoint PS commands ? spadmin ( installer) OR SPFarm account ?

2- In this case installer(spadmin) account is able to run few power shell command like Get-SPSite, but can not run Get-SPWeb unless I add installer(spadmin) account on content database manually and assign shell admin access. Reason it can run get-SPSite ,it has shell admin access on config DB. Is it not be default installer account should be able to run all command and be shell admin on all databases ? client is hesitant to assign shell admin access manually to installer account and I think it should get access during the installation process. any thoughts?

I tried -SecureResiurces already.

btw , install was done using the autospinstaller, yes .

Thanks.

  • I find one response here that says use farm account. Afaik, farm account should not be used to run any process, farm account is used internally by SharePoint to manage its internal operations. Please correct if this is wrong. SpAdmin account is the one that should be used to install and configure every thing. social.technet.microsoft.com/Forums/en-US/… .. – Umr Jul 12 '17 at 20:36
  • Also check out WSS_SHELL_ACCESS database role section ""By default, the setup account is assigned to the WSS_SHELL_ACCESS database role." technet.microsoft.com/en-us/library/cc678863.aspx – Umr Jul 12 '17 at 20:42
2

The account should generally be the assigned account to an individual for accountability. Shared accounts defeat accountability, and to some extent, security (sharing of a password between multiple individuals). These accounts should be "elevated access" accounts; that is, not the day to day account of the individual, but one specifically requiring elevated privileges.

Lastly, all service accounts should have 'Deny logon locally' to prevent them from logging into the SharePoint server(s).

For your other issue, run the following.

foreach($db in Get-SPContentDatabase)
{
    Add-SPShellAdmin 'DOMAIN\Username' -Database $db
}
  • Thanks Trevor for comments, totally agree with accountability part. But by default what is right behavior ? does installer/spadmin account get shell admin access on all DBs ? I see farm admin account can run all PS commands ? @trevor – Umr Jul 12 '17 at 21:20
  • The only time the 'installer' account (the account used to install SharePoint) would have these rights by default is if that account held the sysadmin fixed role on SQL. Otherwise, it must be assigned as I indicated in my answer. – Trevor Seward Jul 12 '17 at 21:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.