Microsoft SharePoint Server
TMA-SHAREPOINT-SERVICE-ACCOUNTS
Ensure web application pools do not run as the farm account
Descripción
The farm account has full control of the configuration database; running content application pools as it means any web-tier compromise owns the farm. Prints the number of web applications whose pool identity is the farm account (expected 0). Run on a SharePoint farm server as a farm administrator; the audit loads the Microsoft.SharePoint.PowerShell snap-in and fails if it cannot.
Cómo se verifica
Método de auditoría: Comando de shell
$ErrorActionPreference = 'Stop'; if (-not (Get-Command Get-SPFarm -ErrorAction SilentlyContinue)) { Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction Stop }; if (-not (Get-Command Get-SPFarm -ErrorAction SilentlyContinue)) { throw 'SharePoint cmdlets are not available' }; $farm = (Get-SPFarm -ErrorAction Stop).DefaultServiceAccount.Name; $bad = @(Get-SPWebApplication -ErrorAction Stop | Where-Object { $_.ApplicationPool.Username -eq $farm }); $bad.Count- Salida esperada
0
Cómo se corrige
Método de corrección: Guía o parche de infraestructura
Register a dedicated managed account (New-SPManagedAccount) and move the application pool: $wa.ApplicationPool.CurrentIdentityType = 'SpecificUser'; $wa.ApplicationPool.Username = 'DOMAIN\svc-sp-apppool'; $wa.ApplicationPool.Update($true); $wa.ApplicationPool.Deploy().
Propiedades
- Sistemas operativos
- Cualquiera
- Etiquetas
- sharepointaccounts
- Referencia
- CIS Microsoft SharePoint Server Benchmark - Service accounts / Least privilege (verify section number for your release)
Verificar este host
Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.
tmaegis scan --target sharepoint