MOSS: Security Notes

When I set up SharePoint, I normally create a few groups before setting up service accounts / users. This way, when the required accounts, I only need to add them to specific AD groups, as opposed to logging on to relevant boxes to grant local admin rights / sql permissions.

The groups I create are as follows:

  • SQLSecurityAdminCreators – A group that is granted the security admin and db creator rights on the sql instance. The setup, farm admins and sql service accounts are added to this group. 
  • SPServerAdmins – A group that has local admin rights on the sharepoint boxes.
  • SPFarmAdmins – Used for central admin / default content access etc. Note – this group actually gets added to the above two groups, and is not issue with any additional perms. This group is just for easier maintenance of  SPFarm accounts.

I also normally create an Organisational Unit in AD named MOSSAccounts to contain all of these users and groups.

Note that this link is the proper way to add accounts, and you should follow this as closely as possible on production environments.


Note that when installing SQL, it should be on a separate box to the DC. As SQL is normally installed from an account that has local administrators rights, but a DC does not have a local administrators group – the way around this would be to install SQL as a Domain Admin – which is not good practice.

You May Also Like

About the Author: rnowik

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.