Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This technet article http://technet.microsoft.com/en-us/library/cc263445.aspx describes the accounts required for a SharePoint 2010 installation. I've always followed this and my clients have never had issues creating so many accounts for a SharePoint installation.

Now this one client has a network administrator who wants to make do with the 3/4 accounts he's already got created for some other SharePoint installation done by a different vendor.

He's argument is that it reduces the number of accounts that must be managed as he is the only one looking after their network and infrastructure.

I think that once created, these accounts don't need to be managed at all and if they do, then this can be done via Central Admin managed accounts section.

Can you guys let me know what the drawbacks are of using one account for say the search services and search content access?

share|improve this question

1 Answer 1

Somethings that come to mind are

  1. Troubleshooting is difficult. When you're scanning logs in a single server farm (with a SQL backend) you'll see the same generic account being used. Where as if you had a seperate account for each service, you'd know exactly where to start looking.
  2. If you're using kerberos, that could be a PITA delegation wise and a security hole IMO
  3. One account gets locked out, everything goes down...
  4. Thinking about it more, theres plenty of other security issues, namely onece the account is comprimised, they have the keys to your sharepoint farm and anywhere else that account has access.

Me personally, I have a service account for each sharepoint service as reccomended by MS. I manage a 2000 user account active directory (i know that's small), so honestly, what's 4 more?

The key for your client, is to have a good way of keeping track of the usernames/passwords and knowing what the user accounts are used for. Sounds more like a managment issue, than a technical one IMO.

share|improve this answer
    
thanks Eric, i agree and i am going to try and get the admin around the using what M$ recommends. –  e p Jan 24 '12 at 23:56

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.