I have read various places that it's best practice to never use your Install account for anything except installation and applying patches. I've also read you should not use your farm account or any other service account to log into the server or do any admin tasks. Do people actually switch to a separate admin account? It seems like "Do as I say, not as I do" because:

Most tutorials leave out details such as what point during the install/configuration I am supposed to switch from spInstall to spAdmin.

I've read a lot of "What accounts do I need" questions on forums and TechNet. The accepted answer on this question doesn't even list an admin account as required.

After reading Todd Klindt's writeup on how to stop using spFarm, I question if it's worth the effort.

What permissions is the Install account going to have that the Admin account won't have or need?

UPDATE: Can anyone provide documentation (preferably from MS) explaining why I shouldn't use the install account for administration?


As almost always with SharePoint the answer is "It depends".

Why should I have a separate Install account?
The main purpose of a separate Install account is to be sure you have an account which is owner of all the installed files and therefore always have the rights to update these. So at least you shouldn't use a personal account for the installation as you may not be there at some upgrade.

Why should I have a separate admin account?
Here are some reasons:

  1. You should not use your own account as this would mean that when you're just browsing the intranet (or whatever your SharePoint is used for) you have too many rights and may do something bad by accident.
  2. You should have a normal account so you normally see the SharePoint environment like everybody else, that'll make it easier for you to understand the users.
  3. You should not use the farm account as all admin changes are then just logged as having been performed by "System". It's a lot easier to troubleshoot (or blame) when you can see who performed the change.

Why don't everybody then always do it?
Well it's more work and most people are lazy.

I'm lazy too what should I do then?
I'd recommend that you do the install/patching using an Install account, that way everbody allways knows which account to use for that.
If you're a small installation I'd probably just use spFarm for doing admin updates, but DON'T run as spFarm as your standard login.

  • Ditto, the farm admin account and install account in a production farm will NOT have the same permissions. The install account needs local admin rights, farm does not. install account needs dbcreator and secadmin rights with SQL, the farm account may or may not have these (although most configuration will, in a locked down environment they can be removed after the farm is deployed). Believe me, if you are in a security focused organization you can get a pretty big delta between the two very quickly. Jul 31 '12 at 0:51
  • Are you talking about a farm admin account, or the farm account that is the app pool identity of central administration?
    – scw
    Jul 31 '12 at 14:37

Being in the lazy camp, when initially installing sharepoint you need local admin, technically a farm account does not (according to documentation)

The one exception is that the user profile service Is going to have problems initially starting during a reboot of the server. So from time to time you'll find that you need to go in, give local admin, do what you need to, and reduce privileges.

You can also get unintended issues, such as this one from the 2007 days.... http://iedaddy.com/2007/12/the-evaluation-version-of-microsoft-office-sharepoint-server-2007-for-this-server-has-expired/

You will also from time to time get errors in your event viewer for things sharepoint farm account tries to access, but can't. One item that comes to mind is the msiinstaller, whic for some strange reason sharepoint uses to check versions on the server with.

So if you don't mind your farm account having local admin and use it for the install and patching, generally that's the way to go for simplicity sake. If you take away local admin you'll get a handful of com+ local activation errors and such in your event logs which can be ignored, although I usually go in and tweak farm permissions so I can take away local admin and not fill my log with errors.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.