Microsoft SharePoint Server
TMA-SHAREPOINT-SERVICE-ACCOUNTS
Ensure web application pools do not run as the farm account
Açıklama
The farm account has full control of the configuration database; running content application pools as it means any web-tier compromise owns the farm. Prints the number of web applications whose pool identity is the farm account (expected 0). Run on a SharePoint farm server as a farm administrator; the audit loads the Microsoft.SharePoint.PowerShell snap-in and fails if it cannot.
Nasıl denetlenir
Denetim yöntemi: Kabuk komutu
$ErrorActionPreference = 'Stop'; if (-not (Get-Command Get-SPFarm -ErrorAction SilentlyContinue)) { Add-PSSnapin Microsoft.SharePoint.PowerShell -ErrorAction Stop }; if (-not (Get-Command Get-SPFarm -ErrorAction SilentlyContinue)) { throw 'SharePoint cmdlets are not available' }; $farm = (Get-SPFarm -ErrorAction Stop).DefaultServiceAccount.Name; $bad = @(Get-SPWebApplication -ErrorAction Stop | Where-Object { $_.ApplicationPool.Username -eq $farm }); $bad.Count- Beklenen çıktı
0
Nasıl düzeltilir
Düzeltme yöntemi: Kılavuz veya altyapı yaması
Register a dedicated managed account (New-SPManagedAccount) and move the application pool: $wa.ApplicationPool.CurrentIdentityType = 'SpecificUser'; $wa.ApplicationPool.Username = 'DOMAIN\svc-sp-apppool'; $wa.ApplicationPool.Update($true); $wa.ApplicationPool.Deploy().
Özellikler
- İşletim sistemleri
- Herhangi biri
- Etiketler
- sharepointaccounts
- Referans
- CIS Microsoft SharePoint Server Benchmark - Service accounts / Least privilege (verify section number for your release)
Bu ana makineyi denetle
Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.
tmaegis scan --target sharepoint