SharePoint farm service account (Database Access account) must be configured with minimum privileges in Active Directory (AD).

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-29306	SHPT-00-000191	SV-37832r2_rule	ECLP-1	Medium

Description
Separation of duties is a prevalent Information Technology control implemented at different layers of the information system including the operating system and in applications. It serves to eliminate or reduce the possibility that a single user may carry out a prohibited action. Separation of duties requires the person accountable for approving an action not be the same person who is tasked with implementing the action. This requirement is intended to limit exposure due to user accounts being used to operate from within a privileged account or role. Limiting the access and permissions of privileged accounts to the minimum required, reduces exposure if the account is compromised and provides forensic history of activity when operating from these accounts. This policy limits the Farm Account privileges in AD. However, default permissions for this account are configured by the SharePoint Products Configuration Wizard during product installation. This account is referred to during the installation as the “Database Access” account. By default, the account is used as the service account for the SharePoint Timer Service and the SharePoint Central Administration Web Site Application Pool. These settings should not be changed. Furthermore, this account should not be used as the service account for non-privileged services, applications, or application pools. See TechNet Article cc678863 for information regarding required permission. The server farm account requires membership in the Domain Users group in Active Directory.

Description

Separation of duties is a prevalent Information Technology control implemented at different layers of the information system including the operating system and in applications. It serves to eliminate or reduce the possibility that a single user may carry out a prohibited action. Separation of duties requires the person accountable for approving an action not be the same person who is tasked with implementing the action. This requirement is intended to limit exposure due to user accounts being used to operate from within a privileged account or role. Limiting the access and permissions of privileged accounts to the minimum required, reduces exposure if the account is compromised and provides forensic history of activity when operating from these accounts. This policy limits the Farm Account privileges in AD. However, default permissions for this account are configured by the SharePoint Products Configuration Wizard during product installation. This account is referred to during the installation as the “Database Access” account. By default, the account is used as the service account for the SharePoint Timer Service and the SharePoint Central Administration Web Site Application Pool. These settings should not be changed. Furthermore, this account should not be used as the service account for non-privileged services, applications, or application pools. See TechNet Article cc678863 for information regarding required permission. The server farm account requires membership in the Domain Users group in Active Directory.

STIG	Date
SharePoint 2010 Security Technical Implementation Guide (STIG)	2012-10-12

Details

Check Text ( C-37713r4_chk )
Verify the account has least privilege in Active Directory. 1. Navigate to Active Directory Users and Computers -> Users. 2. Double click on the account to view the account properties. 3. Select the Members of tab and verify that this account is a member of the Domain Users group only. 4. Mark as a finding if the server farm service account is a member of an Active Directory security groups other than Domain Users.

Check Text ( C-37713r4_chk )

Verify the account has least privilege in Active Directory.
1. Navigate to Active Directory Users and Computers -> Users.
2. Double click on the account to view the account properties.
3. Select the Members of tab and verify that this account is a member of the Domain Users group only.
4. Mark as a finding if the server farm service account is a member of an Active Directory security groups other than Domain Users.

Fix Text (F-32960r3_fix)
Ensure the farm service account has minimum permissions in Active Directory. 1. Navigate to Active Directory Users and Computers -> Users. 2. Double click on the account to view the account properties. 3. Select the Members of tab to view group membership for this account. 4. Remove this account from membership in groups other than Domain Users.