I am working through setting up my search service app and came across a question of why I would use another domain account to crawl my web applications. Currently i've just set it to my farm account, I've seen some documentation that supports the idea of an isolated search domain account for just crawling however and now i'm curious why this would be leveraged, aside from security isolation.



  • Thank you both for your replies, I consider them both answers to my question but can only mark one of them as the true answer...therfore i will not do so as i find them both equally as helpful....
    – Jacob A
    Jun 5, 2012 at 13:10
  • I did find a similar article on the stack that covered how the account actually crawls content in the farm. sharepoint.stackexchange.com/questions/35087/…
    – Jacob A
    Jun 5, 2012 at 13:13

4 Answers 4


The primary reason is that it is recommended to use your farm account for a few services as possible. That account has privileged access to your farm and your servers, so the idea is that by limiting the number of services using that account you are reducing the amount of security risks on your farm.

All that a search service account needs is full read access to each web application.


Content access account need only read SharePoint content, so assigning any more rights or allowing the crawler to run as an administrator or database owner (e.g. using the application pool identity) creates a prime attack surface. Don't do that.

The "best practice" is to use the same account wherever you have the same permission or auditing requirements for two operations, and distinct accounts for each potential attack surface.


The reason for a different domain account for search is because if you use an account with full control, it has access to read draft items, and so draft items would return in search results to people that don't have access to read the draft item.


Search results are also based on users permission so it can crawl also drafts.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.