Share via

  • Article

Administrative and service accounts required for initial deployment (Search Server 2010)

 

Applies to: Search Server 2010

Topic Last Modified: 2010-05-26

Note

The information in this article applies to both Microsoft Search Server 2010 and Microsoft Search Server 2010 Express.

This article provides information about the administrative and service accounts that are required when you install Microsoft Search Server 2010 on the first computer in a server farm. Additional accounts and permissions are required to fully implement all aspects of a production farm.

Required permissions

To deploy Search Server 2010 by using the Server Farm installation option, you must provide credentials for several different accounts.

The following table describes the accounts that are used to install and configure Search Server 2010.

Account Purpose Requirements

SQL Server service account

The SQL Server service account is used to run SQL Server. It is the service account for the following SQL Server services:

  • MSSQLSERVER

  • SQLSERVERAGENT

If you do not use the default SQL Server instance, in the Windows Services console, these services will be shown as the following:

  • MSSQL$InstanceName

  • SQLAgent$InstanceName

Use either a Local System account or a domain user account.

If you plan to back up to or restore from an external resource, permissions to the external resource must be granted to the appropriate account. If you use a domain user account for the SQL Server service account, grant permissions to that domain user account. However, if you use the Network Service or the Local System account, grant permissions to the external resource to the machine account (domain_name\SQL_hostname$).

The instance name is arbitrary and was created when Microsoft SQL Server was installed.

Setup user account

The Setup user account is used to run the following:

  • Setup

  • SharePoint Products Configuration Wizard

  • Domain user account.

  • Member of the Administrators group on each server on which Setup is run.

  • SQL Server login on the computer that runs SQL Server.

  • Member of the following SQL Server security roles:

    • securityadmin fixed server role

    • dbcreator fixed server role

If you run Windows PowerShell cmdlets that affect a database, this account must be a member of the db_owner fixed database role for the database.

Server farm account or database access account

The server farm account is used to perform the following tasks:

  • Configure and manage the server farm.

  • Act as the application pool identity for the SharePoint Central Administration Web site.

  • Run the Microsoft SharePoint Foundation Workflow Timer Service.

  • Domain user account.

Additional permissions are automatically granted for the server farm account on Web servers and application servers that are joined to a server farm.

The server farm account is automatically added as a SQL Server login on the computer that runs SQL Server. The account is added to the following SQL Server security roles:

  • dbcreator fixed server role

  • securityadmin fixed server role

  • db_owner fixed database role for all SharePoint databases in the server farm

Note

We recommend that you install Search Server 2010 by using least-privilege administration.