Microsoft SharePoint Server
TMA-SHAREPOINT-SERVICE-ACCOUNTS
Ensure web application pools do not run as the farm account
Description
The farm account has full control of the configuration database; running content application pools as it means any web-tier compromise owns the farm. Prints the number of web applications whose pool identity is the farm account (expected 0). Run on a SharePoint farm server as a farm administrator; the audit loads the Microsoft.SharePoint.PowerShell snap-in and fails if it cannot.
How it is checked
Audit method: Shell command
$ErrorActionPreference = 'Stop'; if (-not (Get-Command Get-SPFarm -ErrorAction SilentlyContinue)) { Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction Stop }; if (-not (Get-Command Get-SPFarm -ErrorAction SilentlyContinue)) { throw 'SharePoint cmdlets are not available' }; $farm = (Get-SPFarm -ErrorAction Stop).DefaultServiceAccount.Name; $bad = @(Get-SPWebApplication -ErrorAction Stop | Where-Object { $_.ApplicationPool.Username -eq $farm }); $bad.Count- Expected output
0
How it is fixed
Fix method: Guidance or infrastructure patch
Register a dedicated managed account (New-SPManagedAccount) and move the application pool: $wa.ApplicationPool.CurrentIdentityType = 'SpecificUser'; $wa.ApplicationPool.Username = 'DOMAIN\svc-sp-apppool'; $wa.ApplicationPool.Update($true); $wa.ApplicationPool.Deploy().
Properties
- Operating systems
- Any
- Tags
- sharepointaccounts
- Reference
- CIS Microsoft SharePoint Server Benchmark - Service accounts / Least privilege (verify section number for your release)
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
tmaegis scan --target sharepoint