I've installed SharePoint 2010 SP2 on windows server 2012 r2(Domain Controller) and during configuration wizard i determined one of my regular AD users("SPFarm" user in Domain Users group) as my farm administrator(System Account). but i can't do anything and literally "SPFarm" is just a reader in Central Admin.
When i add this user to "Builtin Administrators" or "Domain Admins" Group in AD everythings is fine.
So is this user must be an administrator of my Domain Controller too in order to be a SharePoint Farm Administrator?
asked Jan 12, 2014 at 19:03
-
Can you please specify how your question relates to the "System Account"? Where do you see System account or have you set a policy ?– Stefan BauerCommented Jan 12, 2014 at 20:55
Add a comment
|
3 Answers
NO! Your SharePoint Farm Account does NOT need local admin privileges. So don't give it them! But when you configure user profile service application, you need to have local admin permission on your SPFarm account. But this is only temporary. When the first user profile sync have successfully run, you could (and should) remove local admin permission.
If you only have read access to central admin, you may want to check that SPFarm has db-creator an security-admin right on SharePoint databases.
More on privilieges: Plan administrative tasks in a least-privilege environment (SharePoint Server 2010)
answered Jan 12, 2014 at 22:09
-
4One thing to note is that the Farm Admin must be a Local Admin every time the UPSS is provisioned, which includes post-backup. Because the group token (that is, Local Admin) isn't applied until the account logs off and back on again, the Farm Admin is often just left as a Local Admin on the server running the UPSS.– user6024Commented Jan 12, 2014 at 22:28
-
1@TrevorSeward agreed. And in most environments, that setup usually don't do any harm. But there are cases where it's not OK, on some companies security policies.– Benny Skogberg ♦Commented Jan 12, 2014 at 22:35
SP_Farm doesn’t have to be member of local Administrators.
The setup account (for example SP_Admin) that runs the configuration wizard must be member of local administrators group. When you specify SP_Farm in the wizard then the configuration tool will give the needed permissions to SP_Farm.
After configuring the farm you can add more farm admins in Central Administration -> Security -> Manage farm administrators group. None of them needs to be (and its recommended to not be) members of Local Administrators group.
answered Jan 12, 2014 at 22:25
Two things needs clarification... Usually two main accounts used to configure SharePoint
- SharePoint Setup Account
- SharePoint Farm Admin Account.
If you have both accounts then you don't need SP farm account into local Admin with the exception of UPSS provisioning. But your SharePoint Setup account should be local admin all the times otherwise you cannot perform many actions and Central Admin will be read only...Without Local admin, you cannot create a new web application, cannot browse Security pages, cannot provision services applications, cannot edit alot of settings and even cannot run power shell scripts.
So its your call, if you have 2 accounts then don't add farm admin into local admin groups permanent...Only setup account should be local admins....No need to add into domain admin groups.
answered Jan 12, 2014 at 23:25
