Microsoft SharePoint Server
TMA-SHAREPOINT-SERVICE-ACCOUNTS
Ensure web application pools do not run as the farm account
Opis
The farm account has full control of the configuration database; running content application pools as it means any web-tier compromise owns the farm. Prints the number of web applications whose pool identity is the farm account (expected 0). Run on a SharePoint farm server as a farm administrator; the audit loads the Microsoft.SharePoint.PowerShell snap-in and fails if it cannot.
Kako se proverava
Metod provere: Komanda ljuske
$ErrorActionPreference = 'Stop'; if (-not (Get-Command Get-SPFarm -ErrorAction SilentlyContinue)) { Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction Stop }; if (-not (Get-Command Get-SPFarm -ErrorAction SilentlyContinue)) { throw 'SharePoint cmdlets are not available' }; $farm = (Get-SPFarm -ErrorAction Stop).DefaultServiceAccount.Name; $bad = @(Get-SPWebApplication -ErrorAction Stop | Where-Object { $_.ApplicationPool.Username -eq $farm }); $bad.Count- Očekivani izlaz
0
Kako se ispravlja
Metod ispravke: Smernica ili zakrpa infrastrukture
Register a dedicated managed account (New-SPManagedAccount) and move the application pool: $wa.ApplicationPool.CurrentIdentityType = 'SpecificUser'; $wa.ApplicationPool.Username = 'DOMAIN\svc-sp-apppool'; $wa.ApplicationPool.Update($true); $wa.ApplicationPool.Deploy().
Svojstva
- Operativni sistemi
- Bilo koji
- Oznake
- sharepointaccounts
- Referenca
- CIS Microsoft SharePoint Server Benchmark - Service accounts / Least privilege (verify section number for your release)
Proverite ovaj računar
Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.
tmaegis scan --target sharepoint