locked
Remove SharePoint Admin service account from server group RRS feed

  • Question

  • Hi, our security advisor recommended to remove SharePoint admin service account from the following server groups:

    IIS_IUSRS
    Performance Log Users
    Performance Monitor Users

    We would like to know if SharePoint admin service account can be removed safely from WFE servers especially from IIS_IUSRS group.

    Thanks

    Tee

    Wednesday, June 17, 2020 5:29 AM

Answers

All replies

  • Making this change would put you in an unsupported scenario. The account needs to remain in those groups. I would suggest only following the guidance at https://docs.microsoft.com/en-us/sharepoint/security-for-sharepoint-server/security-hardening and/or contacting Microsoft to open a support case to see about the support of the change you wish to make.

    Trevor Seward

    Office Apps and Services MVP



    Author, Deploying SharePoint 2019

    Author, Deploying SharePoint 2016

    This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

    Wednesday, June 17, 2020 5:36 AM
  • Hi, Tee,

    After a few days, is there any update about your question? You can mark the reply as answer if it solves your question.

    Best Regards

    Jerry


    Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

    SharePoint Server 2019 has been released, you can click here to download it.
    Click here to learn new features. Visit the dedicated forum to share, explore and talk to experts about SharePoint Server 2019.

    Tuesday, June 23, 2020 6:50 AM