I am having difficulty finding out what exact permissions are required in order to run a Cumulative Update (September 2019) on our SharePoint 2010 farm.

I plan to run the installer as our FARM service account, and it currently has db_owner on all relevant databases. Is this all that is required, or will I additionally need sysadmin or something?


1 Answer 1


Users will need:

  • member of the farm administrators group
  • local admin on SharePoint server
  • Security Admin and DBCreator role on SQL
  • db_owner on all existing SharePoint databases

This blog post lays out additional details and recommendations, including a recommendation to grant these permissions to a group rather than individual users, so that you can add/remove these permissions from users more easily. (though, there are caveats to the group approach, read the post for more details).

Also, the farm service account should not be used to install updates, per guidance from MS. That's intended to be used as a service account, and there should be no need for users to log in as that account. If set up correctly, the farm account should not have local admin rights, and therefore wouldn't have the necessary permissions to install a CU.

Of course, install the CU on a test farm first, ensure you have proper backups, etc.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.