Compiled by György Balássy (Microsoft regional director, ASP.NET MVP) – MSDN Competence Center, Hungary
| Account | Summary | Description | Troubleshooting | Scope | Used By | Needed | Requirements | Single server standard requirements | Server farm standard requirements | Least privilege using domain user accounts | Least privilege administration using SQL authentication | Least privilege administration with domain user accounts when connecting to pre-created databases |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Server farm-level accounts | ||||||||||||
|
Setup User
(SPSetup) |
On every server where MOSS is to be installed, the account you run setup with must belong to the local administrators group. In addition, this account must be a Domain User and be a member of the following SQL server security roles: Logins, Securityadmin & Dbcreator. This account is going to be doing a lot – creating new databases, and also creating new IIS sites – so make sure you have enough permissions! Typically, an account such as the domain administrator is used to run the installation, which addresses all of the security requirements. |
The user account that is used to run:
|
Farm | Person installing | Setup | Member of the administrator group on each Web front-end (WFE) server and application server computer in the farm. Member of the following SQL Server groups with SQL Security administrator and database creator rights on SQL servers. | Member of the Administrators group on the local computer |
If you run Stsadm commands that affect a database, this account must be a member of the db_owner fixed database role for the database. |
Server farm standard requirements with the following additions or exceptions:
|
Server farm standard requirements with the following additions or exceptions:
Note You must use the Psconfig command-line tool to create the configuration database and the SharePoint_AdminContent database. You cannot use the SharePoint Products and Technologies Configuration Wizard to create these databases. To create a farm or to join a computer to a farm, specify the SQL Server login that you created for these databases as the dbusername and dbpassword. The same SQL Server login is used to access both databases. All other content databases can be created in Central Administration by selecting the SQL authentication option. |
Server farm standard requirements with the following additions or exceptions:
This account is used to configure databases. After each database has been created, change the database owner (dbo or db_owner) to the Setup User account. |
|
|
SQL Server Service
(SQLService) |
This account is specified when a new SQL server is being brought online or a new instance installed. It typically is used for running both the SQL Server & SQL Server Agent, however, each can have their own account. For our purposes, we will utilize one account for both SQL Server & the Agent. The account only needs to be a basic Domain Account with no specific permissions set. When SQL Server is installed, all of the other appropriate permissions will be granted to the account. |
SQL Server prompts for this account during SQL Server Setup. This account is used for the following SQL Server services:
If you are not using the default instance, these services will have the following names:
This is the security context used by Central Administration for creating databases and other SQL configurations. |
Always use the SQL tools and never the Services MMC to change this account in SQL. | Farm | MSSQLSERVER, SQLSERVERAGENT | Setup | Member of the administrators group on each server on which setup runs, administrators group on each SQL Server computer, database system administrator, and member of the SQL security administrator and database creator SQL Server groups. | Local System account (default) |
Use either a Local System account or a domain user account.
If a domain user account is used, this account uses Kerberos authentication by default, which requires additional configuration in your network environment. If SQL Server uses a service principal name (SPN) that is not valid (that is, that does not exist in the Active Directory directory service environment), Kerberos authentication fails, and then NTLM is used. If SQL Server uses an SPN that is valid but is not assigned to the appropriate container in Active Directory, authentication fails, resulting in a "Cannot generate SSPI context" error message. Authentication will always try to use the first SPN it finds, so ensure that there are no SPNs assigned to inappropriate containers in Active Directory. If you plan to back up to or restore from an external resource, permissions to the external resource must be granted to the appropriate account. If you use a domain user account for the SQL Server service account, grant permissions to that domain user account. However, if you use the Network Service or the Local System account, grant permissions to the external resource to the machine account (domain_name\SQL_hostname$). |
Server farm standard requirements with the following additions or exceptions:
|
Server farm standard requirements with the following additions or exceptions:
Note All database accounts must be created as SQL Server login accounts in Microsoft SQL Server 2000 Enterprise Manager or SQL Server 2005 Management Studio. These accounts must be created before the creation of any content databases, including the configuration database and the SharePoint_AdminContent database. Create one SQL Server login for both the configuration database and the SharePoint_AdminContent database. |
Server farm standard requirements with the following additions or exceptions:
|
|
Server Farm
(SPFarmService) |
This account serves a few roles. The first is that it is used by MOSS to access the databases… it acts as the account by which the server(s) MOSS is installed on communicates back and forth to SQL with (read/write). Additionally, it is used as the identity for the Central Administration application pool & the WSS Timer service. This account needs to be a Domain Account - but note that it is believed to have to be a local admin on every MOSS box - this is not true. |
This account is also referred to as the database access account. This account is:
|
You may receive Access Denied on some pages of the Central Administration site when not
assigned local admin permissions to this account.
If DCOM Error with event ID 10016 is logged to the System Log use the Component Services MMC to assign local activation permission for the IIS WAMREG admin Service to this account. Read KB926959 if you receive Access Denied when trying to edit the content source schedule. Do NOT log in interactively with this account. |
Farm | Central administration site application pool identity | Setup | Member of administrators group on each WFE server and application server computer in the farm with SQL security administrator and database creator rights on SQL Servers. Database Owner (DBO) for all databases and additional permissions on WFE server and application server computers are automatically configured for this account when SharePoint is installed. |
Network Service (default)
No manual configuration is necessary. |
Additional permissions are automatically granted for this account on Web servers and application servers that are joined to a server farm. This account is automatically added as a SQL Server login on the computer running SQL Server and added to the following SQL Server security roles:
|
Server farm standard requirements with the following additions or exceptions:
|
Server farm standard requirements with the following additions or exceptions:
|
Server farm standard requirements with the following additions or exceptions:
After the Shared Services Provider (SSP) database and the SSP search database are created, add this account to the following for each of these databases:
|
| SSP accounts | ||||||||||||
|
SSP App Pool
(SPSSPPool) |
Application pool identity for the shared services administration Web application. | If DCOM Error with event ID 10016 is logged to the System Log use the Component Services MMC to assign local activation permission for the IIS WAMREG admin Service to this account. | App | SSP App Pool Identity | SSP Creation | No configuration is necessary. The following permissions are automatically configured for this account when SharePoint is installed: DBO for the Share Service Provider (SSP) content database, read/write permissions for the SSP content database, read/write permissions for content databases for Web applications that are associated with the SSP, read permissions for the configuration database, read permissions for the central administration content database, and additional permissions on WFE server and application server computers | No manual configuration is necessary. |
No manual configuration is necessary. The following are automatically configured:
|
Server farm standard requirements with the following additions or exceptions:
|
Server farm standard requirements with the following additions or exceptions:
|
Server farm standard requirements with the following additions or exceptions:
|
|
|
SSP Service Account
(SPSSP#Service) |
Each shared service provider can run under its own account, therefore, it is desirable to name the account using a number. This way, if your MOSS farm ends up having a large number of SSPs, you can map the SSPs back to their specific service accounts easily. This account is used for the SSP web services & the SSP timer jobs. The account only needs to be a basic Domain Account with no specific permissions set. |
Used by the following:
|
Farm | SSP Timer service; SSP Web services | SSP Creation | Same as SSP App Pool Account |
|
|
Server farm standard requirements with the following additions or exceptions:
|
Server farm standard requirements with the following additions or exceptions:
|
Server farm standard requirements with the following additions or exceptions:
After the configuration database and the Central Administration content databases are created, add this account to the following for these databases:
After the content database for the Shared Services Administration site, the SSP database, and the SSP search database are created, add this account to the following for each of these databases:
After My Sites are created, add this account to the following for the My Sites Web application content database:
After each content database is created, add this account to the following:
|
|
|
Office SharePoint Server Search Service
(SPSearchService) |
This account is utilized by all of the Shared Service Provider to crawl local & remote content. This account should be a Domain Account & have local administrator permissions on each MOSS server. | Used as the service account for the Office SharePoint Server Search service. There is only one instance of this service and it is used by all SSPs. |
By default, this account runs as the Local System account. If you want to crawl remote content by changing the default content access account or by using crawl rules, change this to a domain user account. If you do not change this account to a domain user account, you cannot change the default content access account to a domain user account or add crawl rules to crawl this content. This restriction is designed to prevent elevation of privilege for any other process running as the Local System account. |
The following are automatically configured:
|
Server farm standard requirements with the following additions or exceptions:
|
Server farm standard requirements with the following additions or exceptions:
|
After the configuration database and the Central Administration content databases are created, add this account to the following for these databases:
After the SSP database and the SSP search database are created, add this account to the following for each of these databases:
|
|||||
|
Search Default Content Access Account
(SPSSP#ContentAccess) |
When a shared service provider crawls content, this is the default account used if a specific account (see below) is not specified for the content source being crawled. This account is specific for each individual SSP. This account should be a Domain Account & have read access to the content sources it needs to crawl. | The default account used within a specific SSP to crawl content, unless a different authentication method is specified by a crawl rule for a URL or URL pattern. | App | Windows SharePoint Services 3.0 Search service | SSP Creation | Must be a domain account, but must not be a member of the farm administrators group. It requires read access to external or secure content sources that you want to crawl using this account. Additional permissions for this account are automatically configured when SharePoint is installed. | No manual configuration is necessary if this account is only crawling local farm content. If you want to crawl remote content by using crawl rules, change this to a domain user account, and apply the requirements listed for a server farm. |
The following are automatically configured:
|
Server farm standard requirements with the following additions or exceptions:
For added security, use a different default content access account for each SSP. |
Server farm standard requirements with the following additions or exceptions:
|
Server farm standard requirements with the following additions or exceptions:
For added security, use a separate default content access account for each SSP. After the configuration database and the Central Administration content databases are created, add this account to the following for these databases:
|
|
|
Search Specific Content Access Account
(SPXXXContentAccess) |
If you have specific content sources that need to be crawled, and you do not want to allow the default content access account to crawl them, then you specify an individual content access account (specified at the time a Crawl Rule is setup). This account is a Domain Account with read permissions specifically on the content source it crawls. | A specific account that is configured to access a content source. This account is optional and is specified when you create a new crawl rule. For example, content sources that are external to Office SharePoint Server (such as a file share) might require a different content access account. | Rule | Windows SharePoint Services 3.0 Search service | Create a new crawl rule | Read access to external or secure content sources that this account is configured to access. | Same as the SSP default content access account listed previously. |
|
Server farm standard requirements with the following additions or exceptions:
|
Server farm standard requirements with the following additions or exceptions:
|
Server farm standard requirements with the following additions or exceptions:
|
|
| User Profile and Properties Content Access Account |
Used to:
If no account is specified, the search default content access account is used. If the search default content access account does not have read access to the directory or directories that you want to import data from, use a different account. You can plan up to one account per directory connection. |
App | Profile Import | SSP Creation | Read access to the directory service. For an Active Directory service connection that enables Server Side Incremental, the account must have the Replicate Changes permissions for Active Directory directory services provided by Windows 2000 Server. This permission is not required for Windows 2003 Active Directory. Manage user profiles right. View rights on entities used in Business Data Catalog import connections. | Same requirements as server farm. |
|
Server farm standard requirements with the following additions or exceptions:
|
Server farm standard requirements with the following additions or exceptions:
|
Server farm standard requirements with the following additions or exceptions:
|
||
| Excel Services Unattended Service Account |
The account that Excel Calculation Services uses to connect to external data
sources that require a non-Windows user name and password string for
authentication. If this account is not configured, Excel Services will not
attempt to connect to these types of data sources. Although the account
credentials are used to connect to non-Windows data sources, the account must be
a member of the domain in order for Excel Calculation Services to use it. The SSP App Pool account is used if none is specified. For security, plan to use a low-privileged account that does not have the database privileges of the SSP App Pool Account. |
App | Excel Services Service | SSP Creation | Read/write access to the Excel data sources. | Must be a domain user account. | Must be a domain user account. | Must be a domain user account. | Must be a domain user account. | Must be a domain user account. | ||
| Windows SharePoint Services Search accounts | ||||||||||||
|
Windows SharePoint Services Search
Service Account (WSSSearch) |
The WSS Services Search is used only to provide search capabilities within the Help content. If this search feature is desired, then this account should be configured as a Domain Account with no specific permissions. | Used as the service account for the Windows SharePoint Services Help Search service. There is only one instance of this service in a farm, and it is used by all SSPs. | Do NOT use the Network Service account (KB927012). | Farm | Windows SharePoint Services 3.0 Search service | SSP Creation | Must be a domain account, but must not be a member of the farm administrators group. Permissions automatically configured for this account when SharePoint is installed include the following: read/write permissions for content databases for Web applications, read permissions for the configuration database, and read/write permissions for the Windows SharePoint Services Search database | By default, this account runs as the Local System account. |
The following are automatically configured:
|
Server farm standard requirements with the following additions or exceptions:
|
Server farm standard requirements with the following additions or exceptions:
|
Server farm standard requirements with the following additions or exceptions:
After the SSP database and the SSP search database are created, add this account to the following for each of these databases:
When running the Psconfig command-line tool to start the Windows SharePoint Services Search service, membership is automatically configured in the following:
|
| Windows SharePoint Services Search Content Access Account | Used by the Windows SharePoint Services Search application server role to crawl content across sites. |
Use the WSS Search Service account as the content access account if error with
event ID 2424 is logged to the Application Log. |
Must not be a member of the Farm Administrators group. The following are automatically configured:
|
Same requirements as the Windows SharePoint Services Search service account. The following are automatically configured:
|
Server farm standard requirements with the following additions or exceptions:
|
Server farm standard requirements with the following additions or exceptions:
|
Server farm standard requirements with the following additions or exceptions:
When running the Psconfig command-line tool to start the Windows SharePoint Services Search service, membership is automatically configured in the following:
|
|||||
| Additional application pool identity accounts | ||||||||||||
|
App Pool Identity
(XXXPool) |
When each application pool is setup, you must specify an account that will be used for that specific application pool’s identity. This account will be used to access the content databases associated with the web application. It is recommended that a new service account is created for each application pool. This should be a Domain Account with no specific permissions. When the account is specified & SharePoint creates the application pool, it automatically grants the account additional needed permissions. |
The user account that the worker processes that service the application pool use
as their process identity. This account is used to access content databases
associated with the Web applications that reside in the application pool.
Plan one for each application pool. |
If DCOM Error with event ID 10016 is logged to the System Log use the Component Services MMC to assign local activation permission for the IIS WAMREG admin Service to this account. | App | Web Applications | App Pool Creation | No configuration is necessary. SQL Server privileges that are automatically assigned to this account are member of Database Owners Group for content databases associated with the Web application, read/write access to the associated SSP database only, and read permission for the configuration database. Additional privileges for this account on WFE servers and application servers are automatically configured by SharePoint. |
No manual configuration is necessary.
The Network Service account is used for the default Web site that is created during Setup and configuration. |
No manual configuration is necessary. The following are automatically configured:
|
Server farm standard requirements with the following additions or exceptions:
|
Server farm standard requirements with the following additions or exceptions:
|
Server farm standard requirements with the following additions or exceptions:
After the SSP database and the SSP search database are created, add this account to the following for each of these databases:
|
Sources: