This article describes the administrative and service accounts required for deploying SharePoint Server 2010 and is a part of a series describing the complete installation of SharePoint Server 2010 on Windows Server 2008 R2 and SQL Server 2008 R2. Please have a look at
There you can find an overview of the complete series and of course the farm topology and the deployment scenario.
Active Directory required accounts
It is strongly recommended to create domain accounts and use them as service accounts. You need to create at least the following accounts in Active Directory:
| Account type |
Account name |
| SQL Service |
sqlSvcAcc |
| Setup Admin |
spAdmin |
| Farm Account |
spFarmAcc |
Additionally you should create for every service a separate service account in order to meet least-privilege security best practice*. (cool phrase isn’t it? ;)
| Account type |
Account name |
Application Pool Account
|
spAppPoolAcc |
| Application Pool Account for BDC Service Application |
spAppPoolBDCAcc |
| Application Pool Account for Excel Service Application |
spAppPoolEXCELAcc |
| Application Pool Account for PowerPoint Service Application |
spAppPoolPPTAcc |
| Application Pool Account for Word Service Application |
spAppPoolWORDAcc |
| SharePoint Foundation Search Service Account |
spfSearchSvc |
| SharePoint Foundation Search Content Access Account |
spfSearchCAAcc |
| more to come... |
|
* You should give a service account only the permissions needed by the service to work properly. E.g. the content access account only needs read permissions. Using the SharePoint Farm Account which is member of the farm administrators group as the content access account isn’t the thing I would do.
Difference to SharePoint 2007
Service accounts in SharePoint 2007 needed 2 properties when they were created in Active Directory:
- User cannot change password and
- Password never expires.
This isn’t necessary with SharePoint 2010 since we now have managed accounts capable of password expiration and automatic change. So in my development environment I will choose the options “User cannot change password” and “Password never expires”.
s
Assign permission
You need to assign permission only to the SharePoint 2010 setup administrator.
SQL Server service account
You don’t need to assign permissions since they are assigned during installation of SQL Server 2008.
The SQL Server service account is used to run SQL Server and should be a domain account.
Setup administrator
You need to manually assign permissions.
The setup administrator is used to install SharePoint 2010.
- The SharePoint 2010 setup administrator has to be a member of the administrators group on every server SharePoint should be installed.
- The SharePoint 2010 setup administrator needs to have the securityadmin and dbcreator role. The sysadmin role is assigned if you decide during SQL Server 2008 installation that your SharePoint 2010 setup administrator should be the SQL admin. I decided to do so in my Hyper-V development environment.
Farm account
You don’t need to assign permissions since they are automatically assigned by the SharePoint 2010 setup administrator.
The farm account is used for the following things [1]:
- “Configure and manage the server farm.”
- “Act as the application pool identity for the SharePoint Central Administration Web site.”
- “Run the Microsoft SharePoint Foundation Workflow Timer Service.”
Resources
Here are the resources used in this article:
Next steps
Please take a look at Part 6: SQL Server 2008 R2 software requirements.
