This is my first install of SP 2010 and I've done my initial steps thru searching for tips, tutorials, and "best practices" but I fear I've got a big blind spot.
In pursuit of "least privilege" for service accounts and "separate domain accounts for each service", I have done the following:
- had my domain administrator add domain accounts for each anticipated service (several experts suggest this but just one example is here)
- using my domainName\sharepointAdmin (account used for the Install of SP2010), I ran "Farm Configuration Wizard"
- at the end of this wizard I chose a "publishing portal" template for my first site (I wanted something that would use Search)
- Now I see Sharepoint Server Search 14 running with domainName\sharepointFarm
- Using the services.msc applet of Windows, I change the identity of Search 14 to domainName\sharepointSearchService
- upon restart, it fails with an "access is denied" error (I change back to sharepointFarm and the service restarts without problems)
Obviously, there are things about sharepointFarm that differ from sharepointSearchService that allow the former to run the service properly.
I think my mistake was running the Farm Configuration Wizard versus configuring everything manually; this was compounded by my quest to run with "separate accounts" to attain "least privilege". Technet describes "service application accounts that are setup by default during installation" but somehow I missed that during my install (my domain admin setup the accounts). Hopefully, my confusion about this is clear?
What would be the best way to fix this?
- Should I abandon "least privilege" and allow sharepointFarm to run the service(s)?
- Is there a way to find out what these accounts need? (I've only found snippets about this, none of which resolve my "access denied" issue)
- Some other way perhaps? (I ordered an 1100 page tome on SP Admin which I should get in a few more days...)
Thanks in advance for your time.
