0

I have read a lot of info about creating a domain account for installing SharePoint 2013. The problem I see with this account is all the SP admins would have to know the password. If someone leaves the company, the password would have to be changed immediately. If it gets over looked, that would be REALLY bad. Can an AD security group be used instead, with all the admins in it? What are the potential problems if I install SP (as a member of the security group) and leave the company? Does the install keep any info in HKCU (vs HKLM)?

If we did enforce the password change policy, that means whoever changes it would have to communicate it to everyone else. It just sounds messy, but maybe it is the best option. Any thoughts?

Improve this question

2 Answers 2

Reset to default
1

I'm assuming this is an on-premise installation. Typically, if someone leaves the company, they will no longer have access to your intranet. Even so, if your data is that important within SharePoint, then it is important enough to have a password change policy that can be reliably enforced.

Microsoft has a great technet article for account setup and management in SharePoint 2013

There is also a process for setting up automatic password management for your SharePoint service accounts via Managed Accounts. I have not used it myself, but I know other farms that have successfully done it.

As for installing SharePoint under your own user account........I would advise against it. If that account was subsequently disabled in Active Directory, there could be many different problems that could occur.

Improve this answer
2
  • Thanks for the reply. Yes, it is on-premise. There is confidential info in our SP instance and we are publically trade company, thereby under SOX. I guess changing the password is the best option, I just preferred a security group...
    – steveareeno
    Commented Feb 20, 2014 at 16:50
  • Didn't see the last comment about user accounts. That is what I kind of thought. Thanks!
    – steveareeno
    Commented Feb 20, 2014 at 16:59
1

Two things keep in the mind, which we mixed up all the times, Install Account & Farm Admin Account.

Farm Admin account is used for running the Central Admin and timer Services and required the elevated permissions. Never this account for the installation & daily task.

Install Account: this account is responsible for all the Installation, Patches(CU), Powershell, daily task, backup & restores. For this account, Never run any app Pool & SharePoint timer jobs...this account have elevated permission i.e Local Admin, DBO rights to all the databases( Content, Config, services db) and fixed role DB Creator & Security admin.

Now back to your question, If you setup your install account with a way that i described above then password change will not cause any issue...But if you run any app pool or any timer services then password change will cause the issue.

In our farm we have dedicated Install account which having full controls but not running any thing and we change the password after 30 days.

here is good article for services account

Improve this answer
2
  • Right, the install account will have nothing to do with SP. It will be more like a server admin acct. I guess my question was whether a security group could be used instead of an "install" domain account. We will definitely have the password change policy on the install account.
    – steveareeno
    Commented Feb 20, 2014 at 16:55
  • i am against the security groups...because then many people have access to the farm, this will cause issue with duties...i.e i am working on restore while other is deploying a solution which automatically do IIS reset will hurt my stuff.
    – Waqas Sarwar MVP ♦
    Commented Feb 20, 2014 at 17:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.