70-541: Create WSS Service Accounts March 25, 2009

Short & Sweet

• For a single server installation you’ll need to run setup as a Local Administrator and you’ll need a normal domain user account (that’s not a farm administrator) for the WSS content access account. Everything else uses Local System or Network System accounts.
• For a server farm installation you’ll need to run setup with an account that’s a Local Administrator on all servers. You’ll need another domain user account to use as the server farm account and a third account, that’s not a farm administrator for the search service and search content access services.

Detailed Information

WSS Service accounts can be broken down into three categories:

1. Server farm-level accounts
2. WSS search accounts
3. Application pool identity accounts

NOTE: SSI = Single Server Installation. SFI = Server Farm Installation

Server Farm-level Accounts

1. SQL Server service account: Used during SQL Server installation.
   • SSI: Local System account. 
   • SFI: Local System account or a domain user account.
2. Setup user account: This is the account that you use to run WSS setup.
   • SSI: Local Administrator account.
   • SFI: Local Administrator on each server. dbCreator and securityadmin on the SQL Server (needs db_owner for certain stsadm commands).
3. Server farm account: Used as the WSS Time service account and is the identity of Central Admnistration’s application pool.
   • SSI: Default value: Network Service.
   • SFI: Domain user account. (Automatically granted special permissions on WSS servers and given dbcreator, securityadmin and db_owner permissions on SQL)

WSS Search Accounts

1. WSS Search Service service account:
   • SSI: Local System by default.
   • SFI: Domain user account that isn’t a member of Farm Administrators. (Automatically be given read access to the configuration database and db_owner for the WSS search database)
2. WSS Search content access account:  Used by WSS Search to crawl site content.
   • SSI: Not a member of Farm Administrator. (Aatomatically added to the Full Read policy for all sites)
   • SFI: Domain user account. Not a member of farm Administrators. (Automatically be added to the Full Read policy for the farm)

Application Pool Identity Accounts

1. Application pool identity account: Used to access content databases.
   • SSI: No configuration. (Network System account used by default)
   • SFI: No configuration. (Automatically made a db_owner for the application pool’s content and search databases, given read access to the configuration database and any other required pemissions are configured automatically).

References

• Plan for administrative and service accounts (Windows SharePoint Services)
  http://technet.microsoft.com/en-us/library/cc288210.aspx
• Windows SharePoint Services security account requirements
  http://go.microsoft.com/fwlink/?LinkId=92885&clcid=0×409