Tag Archives: Permission

Accounts used to install and configure SharePoint 2013

Posted on by
Reply
Account Purpose Requirements
SQL Server service account The SQL Server service account is used to run SQL Server. It is the service account for the following SQL Server services:  MSSQLSERVER  SQLSERVERAGENT   If you do not use the default SQL Server instance, in the Windows Services console, these services will be shown as the following:  MSSQL  SQLAgent Use either a Local System account or a domain user account. If you plan to back up to or restore from an external resource, permissions to the external resource must be granted to the appropriate account. If you use a domain user account for the SQL Server service account, grant permissions to that domain user account. However, if you use the Network Service or the Local System account, grant permissions to the external resource to the machine account (). The instance name is arbitrary and was created when SQL Server was installed.
Setup user account The Setup user account is used to run the following:  Setup  SharePoint Products Configuration Wizard  Domain user account.  Member of the Administrators group on each server on which Setup is run.  SQL Server login on the computer that runs SQL Server.  Member of the following SQL Server roles:  securityadmin fixed server role  dbcreator fixed server role   If you run Windows PowerShell cmdlets that affect a database, this account must be a member of the db_ownerfixed database role for the database.
Server farm account or database access account The server farm account is used to perform the following tasks:  Configure and manage the server farm.  Act as the application pool identity for the SharePoint Central Administration Web site.  Run the Microsoft SharePoint Foundation Workflow Timer Service.  Domain user account.   Additional permissions are automatically granted for the server farm account on Web servers and application servers that are joined to a server farm. The server farm account is automatically added as a SQL Server login on the computer that runs SQL Server. The account is added to the following SQL Server security roles:  dbcreator fixed server role  securityadmin fixed server role  db_owner fixed database role for all SharePoint databases in the server farm

Accounts used by application pools or service identities are in the local machine Administrators group SharePoint

Posted on by
Reply

Rule Name:  Accounts used by application pools or service identities are in the local machine Administrators group.

Summary:  A user account that is used by application pools or services must have permissions of a domain user account and must not be a member of the Farm Administrators group or a member of the Administrators group on the local computer. Using highly privileged accounts for application pools or services poses a security risk to the farm, and could allow malicious code to execute.

Cause:  Accounts that are used by application pools or services are members of the Administrators group on the local computer.

Resolution: Change the user account to a predefined account, or to a domain user account that is not a member of the Administrators group.

  1. Verify that the user account that is performing this procedure is a member of the Farm Administrators group.
  2. On the Central Administration home page, in the Security section, click Configure service accounts.
  3. On the Service Accounts page, in the Select the component to update list, click the application pool or service that uses the credentials of a member of the Administrators group on the local computer as its security account.
  4. In the Select an account list, click an appropriate account for this component — for example, the predefined account Network Service — or click Register new managed account, and then on the Register Managed Account page, specify the credentials and the password change settings that you want.
  5. Click OK.

Sorry we could’t follow the document or site sharepoint 2013

Posted on by
Reply

Problem

Now what this is really about and the reason why you stopped at this post. SharePoint 2013 gives an error when you hit the ‘Follow‘ button with the next message: Something went wrong.

Sorry we could’t follow the document or site sharepoint 2013

Sorry we could’t follow the document or site sharepoint 2013

In this example I tried to follow a document in a library.

Cause

This pop-up doesn’t provide a lot of information. except that it’s not working. The next step is to check the good old SharePoint logs at the ‘15 Hive‘ location: C:Program FilesCommon FilesMicrosoft SharedWeb Server Extensions15LOGS

Analyzing the log file shows that there is a problem opening the content database hosting the users
My Sites. Now it starts to get interesting. reading further down the logs shows the name of the user account that has failed to login. (search the term ‘for Cannot open database’)

Sorry we could’t follow the document or site sharepoint 2013

Sorry we could’t follow the document or site sharepoint 2013

The cause of this problem is that the Application Pool Account has no access to the database. This is most probably caused by the service accounts that are used for the SharePoint default web application and the My Sites web application.

This can easily be checked with a PowerShell script :

Add-WindowsFeature Web-WMI | Format-List
Get-CimInstance -Namespace root/MicrosoftIISv2 -ClassName IIsApplicationPoolSetting -Property Name, WAMUserName, WAMUserPass | select Name, WAMUserName, WAMUserPass

powershell app pool account

powershell app pool account

Solution:

This is what you’ve all been waiting for! How do I solve this annoying issue.
Well the resolution is pretty easy. You have to go to the database server and give the Application Pool Account access to the needed database.

Open your SQL server and correct instance and select the user that you’ve found in the SharePoint log. In my case this was the user: ‘TESTSP_WebApps‘

Go to the Security – Logins node and right-click on the user that you found earlier in the SP Logs and select properties.

Sorry we could’t follow the document or site sharepoint 2013

Sorry we could’t follow the document or site sharepoint 2013

Now select the ‘User Mapping‘ node and select the My Sites content database.
Also select the ‘SPDataAccess‘ and hit the OK button.

SQL login properties user maping settings

SQL login properties user maping settings

Close the SQL Server and go back to your SharePoint site.

Your set to go and ready to follow documents, Libraries, Sites, etc.