SharePoint service accounts and Local Server Groups

Question

I have read most of the security literature and it seems I cant wrap my head around if the servers I own have the correct provisions as far as local server groups and security is concerned.

The server farm uses the high availability (2) Application with Search Servers and (2) Distributed Cache and Web Front ends. as per page 34 in the "Deploying SharePoint 2019" book. Actual service account names are not used only referenced.

QUESTION: Does the below look normal by that I mean security wise.
STATEMENT: I have not in anyway placed the accounts in the groups, I know WSS is for SharePoint I am not sure about the "Performance Log Users" and "Performance Monitor Users". Nothing is broken everything in the Farm is running fine.

Group: IIS_IUSRS
SharePoint Farm Account.svc
SharePoint Service Account.svc
LOCAL SERVICE

Group: Performance Log Users
SharePoint Farm Account.svc
SharePoint Service Account.svc

Group: Performance Monitor Users
SharePoint Farm Account.svc
SharePoint Service Account.svc

Group: WSS_ADMIN_WPG
SharePoint Farm Account.svc
SharePoint Sync Account.svc

Group: WSS_RESTRICTED_WPG_V4
SharePoint Farm Account.svc

Group: WSS_WPG
SharePoint Farm Account.svc
SharePoint Service Account.svc
LOCAL SERVICE

Answer 1

WSS_ADMIN_WPG should only contain the Farm Admin account and any assigned farm admins.

You are missing an account dedicated to web application(s).

Official docs (which are really based off of my book/best practices) are at:

https://learn.microsoft.com/en-us/SharePoint/security-for-sharepoint-server/plan-for-administrative-and-service-accounts

https://learn.microsoft.com/en-us/sharepoint/install/account-permissions-and-security-settings-in-sharepoint-server-2016

Answer 2

Thanks @Trevor Seward for the answer.

Hi @Art , additional to the Trevor’s reply:
Performance Log Users members can access and log performance counter data locally and remotely (create, manipulate, and view logs).
Performance Monitor Users members can access performance counter data locally and remotely (view logs).
These two groups are the default Active Directory Security Groups, your current settings would be fine.
Reference: Active Directory Security Groups.

And for the Application pool identity:

A single account should be used for all Web Applications, named Web Application pool account. This allows the administrator to use a single IIS Application Pool for all Web Applications which increases performance and reduces memory usage on the server.

----------

If an Answer is helpful, please click "Accept Answer" and upvote it.
**Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread. **