1

I have never hardened a SharePoint site before and I am having a hard time using all the recommendations I find online.

This blog post discusses the different accounts that should be used for different purposes, but it doesn't match up with the services I have running on my Foundations server.

This is the list so far of the accounts that I should set up for the various services with "N/A" listed for those that don't seem to be referenced:

  • Sharepoint 2010 Administration - SP_Farm account
  • Sharepoint 2010 Timer - SP_Farm account
  • Sharepoint 2010 Tracing - N/A
  • Sharepoint 2010 User Code Host - N/A
  • Sharepoint 2010 VSS Writer - N/A
  • Sharepoint Foundation Search V4 - SVCSPFoundSearch

Are there services that I have not included here? As a note, my SharePoint site is fully contained on a single server at this time.

2

There are a few more considerations when you are hardening a Sharepoint box. Kerberos, SQL Aliases, firewall policies and fine grained permission policies on the box itself.

I recommend that you take a look at http://technet.microsoft.com/en-us/library/cc288143%28v=office.14%29.aspx and get familiar with SQL Hardening as well http://social.technet.microsoft.com/wiki/contents/articles/1256.database-engine-security-checklist-database-engine-security-configuration.aspx even if you are not the SQL Administrator it cant hurt to know the lingo and how your DBA thinks.

As for the accounts. You should be able to create new accounts in AD and then add the as managed accounts in Central Admin. Then you can assign them as Service accounts. Tracing, User Code host (sandbox) and VSS writer shouldn´t need any explicit permissions that Sharepoint wont give them in the Service Account provisioning process.

Hope this helps.

Funi.

|improve this answer|||||
  • The server is self contained; SQL resides on the same machine as the SharePoint install. Earlier I reviewed the TCP/IP hardening suggestions for SQL and noticed that in the SQL Server Configration Managemer for my instance TCP/IP is disabled. Other than changing the default port (which doesn't even seem to be online) and using a different service account (which I have done) I don't know that there are other steps... – Shrout1 Nov 25 '13 at 17:11
  • And thank you for your suggestion! I am applying it now :) – Shrout1 Nov 25 '13 at 17:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.