I am preparing a SharePoint 2010 (1 WFE/APP + 1 DB) farm. While planning for service account creation , I was wondering do I really need to give Remote Administration Rights to this account.

The account is already in the Administrators Group on both the servers. But I wish to deny Remote Login rights exclusively for this service account.

There are no official documentation concerning the remote desktop rights of a sharepoint service account in MSDN or Technet from what I have read. Would request someone to share some insights on this and let me know the possible pitfalls of not giving remote desktop rights to the SharePoint service accounts.

3 Answers 3


The first thing to keep in mind is that rights are being granted to service accounts, not accounts actually associated with a specific user. So these accounts should not be used to log into a server unless it is a highly specific and unique situation. In fact, you can optionally configure these accounts so that they cannot be used to log on to a server via a physical or remote desktop connection by denying them the Logon Locally right via a Group Policy Object.

Read more: http://salaudeen.blogspot.se/2011/05/sharepoint-2010-service-accounts.html

  • 2
    In fact I would go a step further and say you should NEVER EVER use the service accounts for ANYTHING like logging on to your system. This is a very bad practice. In fact you dont even need to know the passwords of these accounts (since you will never log in with them) so let SharePoint handle these under managed accounts Jun 5, 2012 at 8:55
  • I think Falak and Anders have concisely cleared the confusion I had. Thanks to both of you. I needed this clarity before provisioning the service accounts !!!
    – ArkoD
    Jun 5, 2012 at 11:16

Yes the service account should perform a log in operation at least once on the server that you intend running the User Profile Service application. When establishing the UPSA your service account needs local admin rights. Once you've got it all setup and running you can revoke these rights.

  • I'm not sure why someone downvoted this. The Farm account absolutely needs local administrator rights, as well as the ability to log on for the initial provisioning of the User Profile Service Account. This access can be removed once UPS is provisioned, but SharePoint will be unable to initiate the FIM provisioning if the farm account cannot log on. As pigeon said, the harbar.net write-up covers this.
    – webdes03
    Jun 5, 2012 at 13:45

From the Rational Guide to implementing SharePoint Server 2010 User Profile Syncronization:

The DOMAIN\SPFARM account requires the log on locally right on the machine running the User Profile Synchronization (FIMSync) service. Grant this right via Group Policy or Local Security Policy on that Machine.

1.Security Settings - > Local Policies -> User Rights Assignment -> Allow Logon Locally 2.If on a DC ( you shouldn’t be :)) GPMC.MSC and edit the default domain controller policy 3.Run gpupdate to refresh the policy change To provision the UPS service – we must make the DOMAIN\spfarm account a local administrator of the box hosting the UPS service. Once we are done we can remove this. Don’t try and work around this – you won’t succeed! The local administrator rights are only required during provisioning.

  • James, does that mean remote login should be allowed for the DOMAIN\spfarm account ?
    – ArkoD
    Jun 5, 2012 at 14:17
  • I am silly. Log on locally and remote login have nothing to do with each other. Sorry for my horrible brain fart. Jun 5, 2012 at 23:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.