Service Accounts and Managed Accounts in SharePoint 2010

Following errors generated in the SharePoint Health analyzer,

Error 1 : The server farm account should not be used for other services.

NA\prodspinstall, the account used for the SharePoint timer service and the central administration site, is highly privileged and should not be used for any other services on any machines in the

server farm. 

The following services were found to use this account:

SAM - 80 (Application Pool) ,SharePoint - 8001 (Application Pool) ,SharePoint - 8080 (Application Pool) ,SharePoint - BPSMERFWWF.pxl.int (Application Pool),SharePoint - TelePresence.pxl.int (Application Pool) ,OSearch14(Windows Service) ,Web Analytics Data Processing Service(Windows Service) ,

Remedy: Browse to /_admin/FarmCredentialManagement.aspx and change the account used for the services listed in the explanation. For more information about this rule, see "http://go.microsoft.com/fwlink/?LinkID=142685".

These are the following  are basic accounts we need to configure for SharePoint2010 Env .

SharePoint Installation Account, SharePoint Farm Account, Service Applications Account, Content Web Application App Pool Account, UPS Sync Account(User Profiles),My Site Host Web Application App Pool Account

Managed Service Accounts:

• All Service Application Pool Accounts
• Access Service Application
• BCS Service Application
• Excel Services Service Application
• Metadata Service Application
• PerformancePoint Service Application
• Enterprise Search Service Application
• Secure Store Service Application
• Subscription Settings Service Application
• User Profile Service Application
• Visio Services Service Application
• Web Analytics Service Application
• Word Automation Service Application
• Word Viewing Service Application
• PowerPoint Viewing Service Application
• Security Token Service Application
• All Content Web Application Pools
• Service Instances
• Claims to Windows Token Service
• Document Conversion Launcher Service
• Document Conversion Load Balancer Service
• Microsoft SharePoint Foundation Sandboxed Code Service
• SharePoint Foundation Help Search
• SharePoint Server Search (Enterprise Search)
• Web Analytics Data Processing Service

Service Accounts (should not be managed):

• Search Crawl Accounts
• For Foundation Search and Server (Enterprise) Search
• Unattended User Accounts
• Excel Services Service Application
• Visio Services Service Application
• PerformancePoint Service Application
• (in general, any Secure Store application credentials)
• Object Cache Portal Accounts
• Super User Account
• Super Reader Account
• User Profile
• Synchronization Service Account (listed incorrectly on the FarmCredentialManagement.aspx page)
• Synchronization Connection Account
• Server Search Custom Crawl Rule Accounts
• Any crawl rule that specifies an account other than the default crawl account

Please find the list of Service Accounts and their purpose details as below:

Account	Purpose	Domain Rights	Local Admin Rights	SQL Server Rights	What Happens behind the screen?
SharePoint Installation Account(e.g. sp_install)	Install the SharePoint binaries using the SharePoint Setup Program. Run the SharePoint Product Configuration Wizard. Performs post-installation updates, patches, and installation of products such as language packs. Will provision the server farm account during the SharePoint product config wizard.	Must be Domain User Account. Local User Accounts are not supported.	Member of Local Administrators Group on each server where SharePoint Installer would run (aka. WFE and Application Servers, excluding SQL Server or SMTP Server).	SQL Server Login on the database server. Needs access to the SQL Server where SharePoint 2010 databases will run.Member of following SQL Server Security Roles – SecurityAdmin fixed server role and dbcreator fixed server role. SharePoint setup and psconfig.exe requires these privileges to create databases and to create SQL logins for SharePoint accounts. Not required during installation but may be required for patching (needs to confirm!!) – Member of the db_owner fixed database role, if you are running powershell cmdlets that would affect the database. In reality, installation account requires the SharePoint_Shell_Access database role for any database that you want to create or modify using Windows PowerShell.  This role is currently equivalent to dbowner, but is a separate role.	After you run the configuration wizards, machine-level permissions for this account are added: Membership in the WSS_ADMIN_WPG Windows security group. After you run the configuration wizards, database permissions are added: DB_OWNER on the SharePoint Server 2010 server farm configuration database. DB_OWNER on the SharePoint Server 2010 Central Administration content database. Never have access to the Service Application Databases or Web Application Content Databases Configures the SharePoint 2010 Timer Service (SPTimerV4) to run under farm (sp_farm) account Configures the SharePoint Admin Windows Service (SPAdminV4) to run under Local System user Configures the SharePoint VSS Writer (SPWriterV4) to run under Local System user Configures the SharePoint Tracing Service (SPTraceV4) under Local Service user
SharePoint Farm Account(e.g. sp_farm)	This account is automatically configured during the SharePoint Configuration Wizard.Also known as Database Access Account for the SharePoint_Config  database on the SharePoint Configuration Wizard. Used for Configure and Manage the SharePoint Farm. Becomes the owner of the farm. In other words, its configured as a dbowner of the SharePoint Config database. Act as an application pool identity for the SharePoint Central Admin. Runs the SharePoint Foundation Timer Service (SPTimerV4). Preferred to use this account to run the User Profile Sync Service. Using this account, you can add additional farm administrators from the central administration site.	Can be local user account or domain user account.Must be domain account if SQL Server is hosted on another server.	Although it is not required for full time term, farm account should be Member of Local Administrators Group on each server where SharePoint Installer would run (aka. WFE and Application Servers, excluding SQL Server or SMTP Server). It will provide ease of access for the SharePoint Admins.Must be on the Member of Local Administrators Group on the server during UPS Service provisioning process.	None	This account will be registered as Managed Service Account in the Central Administration.After you run the configuration wizards, Additional permissions are automatically granted to the server farm account on Web servers and application servers that are joined to a server farm. Membership in the WSS_ADMIN_WPG Windows security group for the SharePoint Foundation 2010 Timer service. Membership in WSS_RESTRICTED_WPG for the Central Administration and Timer service application pools. Membership in WSS_WPG for the Central Administration application pool. Member in the built-in IIS_IUSRS on IIS 7 (Windows Server 2008) and IIS 7.5 (Windows Server 2008 R2), IIS_IUSRs replaces earlier version IIS_WPG built-in group After you run the configuration wizards, SQL Server and database permissions for sp_farm includes: Added as SQL Server Login to DB Server Added as DBCREATOR fixed server role because when you create new web applications and content databases, Central Administration’s application pool identity (sp_farm) has to be able to create those databases on the SQL server. Added as SECURITYADMIN fixed server role because Central Admin can create SQL Server logins when you create managed accounts or modify app pool identities.  Each web application pool’s identity must have a login for that web application’s content databases. Added as a DB_OWNER fixed database role for all the SharePoint databases (e.g. configuration databases, service application databases, or content databases) on the farm. Added as a WSS_CONTENT_APPLICATION_POOLS and SHAREPOINT_SHELL_ACCESS fixed database roles for the SharePoint Server 2010 server SharePoint_Config and SharePoint_AdminContent databases.
Service Applications Account(e.g. sp_serviceapps)	Application Pool identity to run the majority of the all the SharePoint 2010 Service Applications (WCF endpoint) as the IIS  worker process (e.g. Managed Metadata Service and/or User Profile Service).Please note that both Service Application App Pool and Web Application App Pool behaves same. You can create more than 1 service account to isolate the IIS processes under services will run.	Must be Domain User Account.Must register as SharePoint Managed Account.	None	None	After you create the SharePoint Service Application, following machine-level permission is configured automatically: Member in the WSS_WPG Member in the built-in IIS_IUSRS on IIS 7 (Windows Server 2008) and IIS 7.5 (Windows Server 2008 R2), IIS_IUSRs replaces earlier version built-in group, IIS_WPG After you create the SharePoint Service Application, following SQL Server and database permissions for this account are configured automatically: This account will be assigned to the db_owner role for the service application content databases (e.g. Managed Metadata, User Profile DBs etc.) Never have access to the associated web application content databases. This account is assigned to the WSS_CONTENT_APPLICATION_POOLS role associated with the farm configuration database. This account is assigned to the WSS_CONTENT_APPLICATION_POOLS role associated with the SharePoint_Admin content database.
Content Web Application App Pool Account(e.g. sp_defaultwebapp)	Application Pool identity to run the IIS Site hosting the SharePoint Content Web Applications and SharePoint Site Collections as the IIS  worker process.Please note that both Service Application App Pool and Web Application App Pool behaves same It is best practice to run all the content web applications in their dedicated application pool account.	Must be Domain User Account. Must register as SharePoint Managed Account.	None	None	After you create the SharePoint Web Application, following machine-level permission is configured automatically: Member in the WSS_WPG Member in the built-in IIS_IUSRS on IIS 7 (Windows Server 2008) and IIS 7.5 (Windows Server 2008 R2), IIS_IUSRs replaces earlier version built-in group, IIS_WPG After you create the SharePoint Web Application, following SQL Server and database permissions for this account are configured automatically: This account is assigned to the db_owner role for the Web application content databases. This account is assigned to the WSS_CONTENT_APPLICATION_POOLS role associated with the farm configuration database. This account is assigned to the WSS_CONTENT_APPLICATION_POOLS role associated with the SharePoint_Admin content database. This account will be assigned to the db_owner role for the associated user profile service application databases (e.g. Profile DB, Sync DB, and Social DB)
UPS Sync Account(e.g. sp_ups)	Perform the User Profile Sync. FIM uses this account to import the AD profiles. Specify on the Synchronization Connection on the User Profile Service Administration Page.	Domain User Account with Replicating Directory Changes Permission. No need to register as SharePoint Managed Account.	None	None	None
My Site Host Web Application App Pool Account(e.g. sp_mysiteapp)	Application Pool identity to run the IIS Site hosting the My Sites Web Applications and User Personal Sites as the IIS  worker process.	Must be Domain User Account.Must not be a member of the farm administrators group.	None	None	After you create the My Site Host, machine-level permission is configured automatically Member in the WSS_WPG Member in the built-in IIS_IUSRS on IIS 7 (Windows Server 2008) and IIS 7.5 (Windows Server 2008 R2), IIS_IUSRs replaces earlier version built-in group, IIS_WPG After you create the My Site Host, SQL Server and database permissions are configured automatically: This account is assigned to the db_owner role for the My Site Host Web application content databases. App Pool account is assigned to the WSS_CONTENT_APPLICATION_POOLS role associated with the farm configuration database. App Pool account is assigned to the WSS_CONTENT_APPLICATION_POOLS role associated with the SharePoint_Admin content database. This account will be assigned to the db_owner role for the associated user profile service application databases (e.g. Profile DB, Sync DB, and Social DB)