cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
I want to move to Least-Privilege, but my farm is already in Production. What do I do?
By
Christopher Weaver
Published May 15 2019 03:05 PM 265 Views
Christopher Weaver
Microsoft
‎May 15 2019 03:05 PM

I want to move to Least-Privilege, but my farm is already in Production. What do I do?

‎May 15 2019 03:05 PM

First published on TECHNET on Sep 24, 2012

Hello All,

 

Not sure how often others see this, but I seem to hit this question all the time.  I usually show up and the environment is built and in production, users are connected and working and the security team has told the SharePoint Admins that they have to move to a Least-Privilege environment.  We have to minimize issues and downtime that could happen from a change like this.  And these are the steps I recommend.

 

To setup least privilege in a SPS2010 farm that has already be configured with a single account here is what I would do.

 

Decide what accounts you want to use for what functions.  There are many different opinions out there and I will not say any are wrong but     you could certainly use the word 'complex' to describe some of them.  Here is what I would do based on my experiences.



        1. Setup Account



          1. Would be used to install SharePoint bits to servers

 

          1. Install Service Packs/Hotfixes/Cumulative Updates to servers.

 

          1. Run psconfig on all servers



        1. Farm account



          1. This account is used for configuration of the farm and all it's objects.

 

          1. It is the log on account for the Central Admin Application Pool.

 

          1. It is the service account for the User Profile Service Application



        1. Service Application - Application Pool Account



          1. The log on account for all Application Pools that are used by Service Application like Search, Manage Metadata, etc

 

          1. Due to security boundaries within your industry or company there could be reason to have two or more of these.



        1. Web Application - Application Pool Account



          1. The log on account for the application pools that are used by your Web Applications.

 

          1. Due to security boundaries within your industry or company there could be reason to have two or more of these.



        1. Crawl Account



          1. The account that is used by the crawl process for authentication.



        1. User Profile Connection Account



          1. The account that is used by the User Profile Service when it is synchronizing with a domain.



We need to decide what you will do with the single account that is currently in use.  My suggestion is that it becomes the Farm Account that way we will need to make only a few changes in its permissions.

 

We need to assign permissions to the remaining six accounts.  I will list all six account and you can decide which account you will use for Step#2 (Don't need to add anything for that account).  You will need to add the following permissions for your newly created accounts.



        1. Setup Account



          1. Add it to the following local groups on each SharePoint server



            1. Local Administrators

 

            1. WSS_ADMIN

 

            1. IIS_WPG



          1. In SQL it requires the following permissions



            1. db_owner for the configuration database

 

            1. db_owner for the Admin Database



          1. In SQL it needs to have the following roles



            1. Security Admin

 

            1. dbcreator



        1. Farm account



          1. Add it to the following local groups on each SharePoint server



            1. WSS_ADMIN_WPG

 

            1. WSS_WPG

 

            1. WSS_RESTRICTED_WPG



          1. In SQL it needs the following roles



            1. Dbowner for all databases

 

            1. Dbcreator fixed server role

 

            1. Securityadmin fixed server role

 

            1. For Config and Admin Content databases add the account to the role WSS_CONTENT_APPLICATION_POOLS



        1. Service Application - Application Pool Account



          1. Add it to the following local groups on each SharePoint server



            1. Member of WSS_WPG



          1. In SQL it needs to have the following roles



            1. For Config and Admin Content databases add the account to the role WSS_CONTENT_APPLICATION_POOLS

 

            1. For all Service Applications databases add to db_owner role



        1. Web Application - Application Pool Account



          1. In SQL it needs to have the following roles



            1. Assigned to db_owner role on all Content Databases

 

            1. For Config and Admin Content databases add the account to the role WSS_CONTENT_APPLICATION_POOLS



        1. Crawl Account



          1. In SQL it needs



            1. For the Config and Admin Content databases it needs read permission

 

            1. For Search Service databases add to db_owner role



          1. In the farm



            1. Needs to have full read to all Web Applications, suggest you use a policy for this.

 

            1. Insure that this account has no more than this if it is an account that has any kind of full permissions you run the risk of crawling unpublished versions of pages.



          1. For any external sources being crawled ie File Shares, Other farms



            1. It requires that full read be assigned to the account.

 

            1. Insure that this account has no more than this if it is an account that has any kind of full permissions you run the risk of crawling unpublished versions of pages.



        1. User Profile Connection Account



          1. Account requires replicate directory changes on the root of the domain

 

          1. If the NETBIOS name does not equal the FQDN ie atoscorp compared to atos.com then the account requires replicate directory changes on CN=Configuration for the domain.  As well if there is a root domain we require replicate directory changes to the CN=Configuration container for it as well



Now that we have assigned all the permissions we need to place those accounts into the proper permissions in the farm.  This step should be performed during off hours as it could cause small (~15 min outages as the system changes log on accounts and resets app pools)



        1. Open Central Admin

 

        1. Go to Security -> Configure Managed Accounts

 

        1. And add all accounts as a managed account

 

        1. Then go to Security ->  Configure Service Accounts

 

        1. And you will configure each service by following these steps, continue till you have completed all the components



          1. Select a component by using the drop down

 

          1. Select an account for the component by using the following matrix



            1. Farm Account component goes with Farm Account

 

            1. Windows Service - Claims to Windows Token Service component goes with Farm Account

 

            1. Windows Service - Document Conversions Launcher Service component goes with Farm Account

 

            1. Windows Service - Document Conversions Load Balancer Service component goes with Farm Account

 

            1. Windows Service - Microsoft SharePoint Foundation Sandboxed Code Service goes with Farm Account

 

            1. Windows Service - SharePoint Foundation Search goes with Service Application - Application Pool Account

 

            1. Windows Service - SharePoint Server Search goes with Service Application - Application Pool Account

 

            1. Windows Service - User Profile Synchronization Service goes with Farm Account

 

            1. Windows Service - Web Analytics Data processing Service goes with Service Application - Application Pool Account

 

            1. Web Application - <Web Application Name> goes with Web Application - Application Pool Account

 

            1. Service Application Pool - <Service Application> goes with Service Application - Application Pool Account



          1. Click ok



Then to configure the crawl account perform the following




      1. Go to General Application Settings -> Farm Search Administration

 

      1. Click on the link Search Service Application

 

      1. Find the status for 'Default content access account' click on the account name to the right

 

      1. Enter the user name and password

 

      1. Click Ok



Then to configure the Active Directory Connection Account perform the following



      1. Go to Application Management -> Manage Service Applications

 

      1. Select your User Profile Service Application and select Manage

 

      1. Click on Configure Synchronization Connections

 

      1. Select each Connection and edit

 

      1. Put in the new Username and Password

 

      1. Once you have completed all connections, perform a full impor



Then we will have to remove permissions from the account in Step#2 to secure the farm.  If we assume that your single account became the farm admin account you would have to remove the following permissions:



      1. Remove it from the following local groups on all SharePoint Servers



        1. Local Administrator

 

        1. WSS_Admin

 

        1. IIS_WPG



Articles of Interest

 

Plan for administrative and service accounts (SharePoint Server 2010) http://technet.microsoft.com/en-us/library/cc263445.aspx

 

Account permissions and security settings (SharePoint Server 2010) http://technet.microsoft.com/en-us/library/cc678863.aspx

 

Initial deployment administrative and service accounts (SharePointServer 2010) http://technet.microsoft.com/en-us/library/ee662513.aspx

0 Likes
Like
Version history
Last update:
‎Apr 28 2020 02:50 PM
Updated by:
Labels