On our SharePoint 2013 (SP1) farm, we require the User Profile Service Application (UPA) for saving SAML user claims in the user profile via 3rd party solution, beyond this we do not utilize UPA. Some other comments on our farm:

  • We do not need the User Profile Synchronization Service (UPS)
  • We do not need MySites

I have read some conflicting information on UPA/UPS,therefore I have a couple of questions on the requirements for provisioning and running only UPA:

  1. Does the farm account need to be in the local administrator group at any point during provisioning or patching?
  2. Does the farm account need local logon rights at any point?
  3. If I am provisioning UPA using PowerShell, do I need to execute any part of the script under the context of the farm account, or can it be executed all using the SP install account?

Thanks for any insight.

1 Answer 1


If you have separate Install account which is responsible for all tasks related to installation, configuration, patching, running powershell or other routine task than farm account does not required local admin rights on the server. I think you mentioned that you have SP install account then you dont need to put your farm admin into local admin.

If you are not using the sync at all then it is not required local admin at any give point of time.

  • 1
    There's no reason the farm admin needs 'allow log on locally'. It should be explicitly set as 'deny log on locally'.
    – user6024
    Commented May 4, 2018 at 14:53
  • HI Trevor, Vlad also mentioned the same absolute-sharepoint.com/2017/03/…
    – Waqas Sarwar MVP
    Commented May 4, 2018 at 14:56
  • 1
    That's not correct, though. I'll ping him.
    – user6024
    Commented May 4, 2018 at 14:59
  • i correct my self. updated
    – Waqas Sarwar MVP
    Commented May 4, 2018 at 15:00
  • 1
    Thank you both for the prompt responses. Yes we are using a separate account for setup & patching activities. And yes, as of current, the domain admins deny interactive logon for regular service accounts unless requested and approved, so the farm account does not have this right. I asked about the log on locally as that article linked in the comment above and in some other old SharePoint 2010 posts list this as a requirement. I am glad I had my skepticism and asked.
    – cpiasecki
    Commented May 4, 2018 at 19:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.