Ensure the SharePoint farm service account (database access account) is configured with the minimum privileges for the local server.

$ErrorActionPreference = 'Stop'; if (-not (Get-Command Get-SPFarm -ErrorAction SilentlyContinue)) { Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction Stop }; if (-not (Get-Command Get-SPFarm -ErrorAction SilentlyContinue)) { throw 'SharePoint cmdlets are not available' }; $acct = "$((Get-SPFarm -ErrorAction Stop).DefaultServiceAccount.Name)"; if ($acct -notmatch '\\') { throw 'farm account not found' }; $dom, $sam = $acct.Split('\', 2); $re = '/' + [regex]::Escape($dom) + '/' + [regex]::Escape($sam) + '$'; $allowed = @('WSS_RESTRICTED_WPG','WSS_ADMIN_WPG','WSS_WPG'); $pc = [ADSI]("WinNT://" + $env:COMPUTERNAME + ",computer"); $bad = @($pc.Children | Where-Object { $_.SchemaClassName -eq 'group' } | Where-Object { $allowed -notcontains "$($_.Name)" } | Where-Object { $paths = @($_.Invoke('Members') | ForEach-Object { $_.GetType().InvokeMember('ADsPath', 'GetProperty', $null, $_, $null) }); @($paths | Where-Object { $_ -match $re }).Count -gt 0 }); $bad.Count

tmaegis scan --target sharepoint