Tips for Sharepoint account settings

"Best practices"Yes:

The same account is used at any time for operations with the same permissions or monitoring requirements.

Assign different accounts for each possible attack surface.

 

1. the application pool of one Sharepoint is damaged, but it will never affect the other. The two SharePoint application pool accounts can be the same. for example, if a WFE web application is hacked, the management center should not be hacked. Therefore, the two web applications should run in different app pools, and use different identity.

 

2. The content access account must have read-only permission on the content in Sharepoint. Granting The dbowner or administrator permission to the content access account increases the risk of being attacked. Do not do this.

 

3. in the standlone Environment, Local Accounts is enough. typically, it is the development environment. when you need to completely copy to the production environment, it is a good idea to add this machine to the domain and use the appropriate domain account to configure it.

 

4. do not directly modify the account of the app pool in IIS (unless this is the only method ). if there is a Sharepoint method, it is best to do it in this way. another simple rule is: "Never modify the Database ".

 

5. if you want to modify something, log on with the domain admin account and modify it again. sharePoint usually needs to modify many things and requires many permissions. using domain admin to log on will save you a lot of time and effort to quickly complete the modification.

 

References:

How to change service accounts and their passwords in moss and WSS 3.0

Http://weblogs.asp.net/erobillard/archive/2007/07/06/how-to-change-service-accounts-and-their-passwords-in-moss-and-wss-3-0.aspx