SharePoint 2013 : Service Account & Permissions required for Search Service Application

 

Following Least Privilege Principle, i always wanted to nail down on permissions required to setup, manage and administer SharePoint, recently working quite a lot on ensuring how important it is working with a close environment which mimics Production environment which makes you sleep as you code won’t fail in such environment as you already tested and built code to very similar environment.

There has been good documentation on setting up SharePoint environment with detail account permission on Servers and SQL Server

Account permissions and security settings in SharePoint 2013

I found it really hard to nail down for Search Service Application, People have done quite a lot work to get the PowerShell scripts to deploy different search topology but i couldn’t find one where they are talking about very specific permissions required.

So i just wanted to document what I've experienced and got the search service application working without issues.

I already have my SharePoint Farm Build with best Practice and followed Least Privilege Principle.

Note: As per Microsoft documentation the Farm Account doesn’t need to be a local administrator, but it is required when you need to perform User Profile Synchronization. With such exception I’ve tried to get very similar workaround working for search. I’m going to setup default search topology as this is my development environment but still wanted to keep it inline with Least Privilege Principle.

Current environment

DC Server : Windows 2012, Hosting Active Directory Domain Service, DNS

APP Server : Windows 2012, SharePoint 2013, SQL Server 2012, all the service Applications.

For search Service Application, i created following Accounts and added them as Managed account.

ACCOUNT	Comments
WS_SEARCH_CRAWL	Windows Service OSearch15 / SharePoint Server Search 15
WS_SEARCH_HC	Windows Service SPSearchHostController / SharePoint Search Host Controller
AP_SEARCH_QSS	App pool for Query Site and Settings Web Service
AP_SEARCH_AWS	App pool for Search Admin Web Service
SP_SEARCH_DC	Service Account for Default Content Access

I like prefixing the accounts for what they are used for

Following is the step i performed for setting up Search Service Application.

1. Logged in as Farm account, note: my farm account is added to local admin group as it is needed for profile synchronization.

2. Assigned

WS_SEARCH_HC to Windows Service - Search Host Controller Service

WS_SEARCH_CRAWL to Windows Service - SharePoint Server Search

CA—> Security –> Configure Managed Accounts.

3. Started following services from

CA –> System Settings –> Mange Services on Server

Search Host Controller Service

Search Query and Site Settings Service

SharePoint Server Search

4. Created Search Service Application and assigned respective service accounts (domain accounts) as below.

Search Service Account : WS_SEARCH_CRAWL

Application Pool for Search Admin Web Service : AP_SEARCH_AWS

Application Pool for Search Query and Site Settings Web Service : AP_SEARCH_QSS

5. Restarted my App Server.

6. Started getting error in log as access denied for Search Host controller not able to access Search_Service_Application_DB_{guid} so explicitly added the login rights for WS_SEARCH_HC –> Search_Service_Application_DB_{guid} and also gave SPSearchDBAdmin role

7. Restarted the server again to ensure things are smooth, again got errors, and it happened to be WS_SEARCH_CRAWL account doesn’t have SPSearchDBAdmin role on all the four search database, so gave/added the role.

8. Again started getting error in ULS log which was not quire really sure why but was related to gatherer and this was only solved by giving WS_SEARCH_CRAWL Account giving Local Admin access. Note once you give local admin rights to any account you need to restart/log-in/log-off once to take it into affect, so i again i restarted.

9. Well till now i was not getting any error in my ULS log, so i thought of changing my default content access account to SP_SEARCH_DC from WS_SEARCH_CRAWL which has higher rights now.

10. slowly after sometime i started getting error in ULS where the WS_SEARCH_HC service was not able to login on Search_Service_Application_DB_{GUID} which i gave along with SPSearchDBAdmin role.

11. I also need to give WS_SEARCH_HC permission on Search_Service_Application_LinksStore_{guid} with SPSearchDBAdmin role.

12. Again i restarted, and did a full crawl i don’t see a single error in my event log and search is working absolutely fine.

Hope to get more granular permission details from MS Documentations with proper justification soon so that should fix this workaround.

Thanks

Akhilesh

 

Side by Side – Virtual Box + Hyper-V (Windows 8 Pro) – Solve with Different Boot Configuration

 Side by Side – Virtual Box + Hyper-V (Windows 8 Pro) – Solve with Different Boot Configuration

As excited as you, I recently started working on Windows 8, wanted to run my old Virtual Box VMs instead of converting/importing them in Hyper-V. Without a hitch I installed Virtual Box on my fresh Windows 8 Pro, being very curious and greedy I also wanted to use Hyper-V, but due to project work couldn’t really get all my VM’s completely imported in Hyper-V, but for the sake of future use, I added the feature of Hyper-V in Windows 8 Pro, assuming that the Hyper-V technology from Virtual Box will run seamless as use to run on earlier Windows 7 64bit, I started my VMs in Virtual Box and what a mess I was stopped with an Error,

What is this? Why can’t I run my old Virtual Box enabled VM’s with Virtual Box any more. Well that’s something not a new story, to cut the story short, it because both the technology won’t work side-by-side because they rely on the same feature Hypervision, and only one can use it at a time, so how do we solve the problem, this could be easily solved by creating a different boot configuration with hypervisorlaunchtype status OFF, this shuts off Windows Hyper-V technology and thus enables 3^rd party like Virtual Box to use the Hypervision.

Disabling “hypervisorlaunchtype” status

1.      Open the command prompt with (Run as Administrator)

2.      Copy the current boot configuration and name it something very relative “Windows 8 (No Hyper-V)”

Some points to note, {current} token resembles your current boot configuration. FYI I had my Hyper-V enabled before following these steps, so I assume you also will have hyper-v enabled on your Windows 8.

Once you copy, it will give back you a Guid, which will be a unique identifier for your boot-configuration.

3.      Now keep a note of the Guid (this will differ on your machine) and perform further step, to disable the Hypervision

C:\Windows\system32>bcdedit /set {use-your-guid} hypervisorlaunchtype OFF

The above step will disable the Hyper-v for the copied boot configuration.

4.      Re-start your machine and this will ask you to choose which operating system to load

               Choosing the “Windows 8 (No Hyper-V) will again re-start your PC, to ensure that your Windows 8 is booted up with Hyper-V disabled, and this will happen every time you select this option.

               You can switch to Windows 8 (which is Hyper-V enabled) by select the option on another reboot, by doing this on contrary this won’t restart the PC again as in case of Windows 8 (No Hyper-V)

5.      After restart it will as normal as using Windows 8 (with No Hyper-V).

Disclaimer: This is not supported and not a best way to work, indeed an un-supported workaround to enable both Virtual-Box and Hyper-V run side by side. Configure this at your own risk, you are responsible for your actions.

Hope this helps J