Ensure Farm Administrators group membership is restricted

高レベル 1手動レビューsharepoint

説明

Farm Administrators have full control over every server and site collection; membership must be limited to named administrators.

チェック方法

監査方法: 手動レビュー

この推奨事項は自動ではチェックできません。--include-manual を指定すると、スキャン結果にこの手順付きで一覧表示されます。

Central Administration > Security > Manage the farm administrators group: confirm only approved named admin accounts [and BUILTIN\Administrators if required] are members; no users, broad groups or service accounts other than the farm account. Also check Get-SPShellAdmin output and the local Administrators group on each farm server.

修正方法

修正方法: ガイダンスまたは IaC パッチ

Remove unapproved members from the Farm Administrators group in Central Administration and with Remove-SPShellAdmin; document approved membership.

プロパティ

オペレーティングシステム: すべて
タグ: sharepointaccounts
参照: CIS Microsoft SharePoint Server Benchmark - Service accounts / Farm Administrators group (verify section number for your release)