Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm currently in the process of setting up a SharePoint 2010 farm. In my Dev Environments, I have one account that is Local Admin, Farm Administrator and runs all Application Pools.

For Production Environment, I would like to go with best Security Practices and run the Web Applications (At least 2: Main Portal and My Sites) with separate Domain Accounts.

It's been some time that I worked with IIS, and I remember that there were issues with accessing files in c:\inetpub by non-Admin users. On the other hand, SharePoint "automagically" sets most permissions anyway.

Does anyone have some experience with which permissions I need to give to the domain account at minimum in order to work?

share|improve this question
up vote 1 down vote accepted

Check out this technet article for the gory details. Basically, your application pool account is assigned to the WSS_WPG group on the server. WSS_WPG is then assigned access to various registry keys and files/folders. There is a table in the linked document with all of the actual permissions for WSS_WPG.

share|improve this answer
A great, that article is new and really detailed, thanks! – Michael Stum Jun 8 '10 at 23:16

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.