Microsoft SharePoint Server
TMA-SHAREPOINT-SERVICE-ACCOUNTS
Ensure web application pools do not run as the farm account
説明
The farm account has full control of the configuration database; running content application pools as it means any web-tier compromise owns the farm. Prints the number of web applications whose pool identity is the farm account (expected 0). Run on a SharePoint farm server as a farm administrator; the audit loads the Microsoft.SharePoint.PowerShell snap-in and fails if it cannot.
チェック方法
監査方法: シェルコマンド
$ErrorActionPreference = 'Stop'; if (-not (Get-Command Get-SPFarm -ErrorAction SilentlyContinue)) { Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction Stop }; if (-not (Get-Command Get-SPFarm -ErrorAction SilentlyContinue)) { throw 'SharePoint cmdlets are not available' }; $farm = (Get-SPFarm -ErrorAction Stop).DefaultServiceAccount.Name; $bad = @(Get-SPWebApplication -ErrorAction Stop | Where-Object { $_.ApplicationPool.Username -eq $farm }); $bad.Count- 期待される出力
0
修正方法
修正方法: ガイダンスまたは IaC パッチ
Register a dedicated managed account (New-SPManagedAccount) and move the application pool: $wa.ApplicationPool.CurrentIdentityType = 'SpecificUser'; $wa.ApplicationPool.Username = 'DOMAIN\svc-sp-apppool'; $wa.ApplicationPool.Update($true); $wa.ApplicationPool.Deploy().
プロパティ
- オペレーティングシステム
- すべて
- タグ
- sharepointaccounts
- 参照
- CIS Microsoft SharePoint Server Benchmark - Service accounts / Least privilege (verify section number for your release)
このホストをチェック
監査が許可されているマシンで実行してください。スキャンは読み取り専用です。
tmaegis scan --target sharepoint