Required Accounts and Permissions for Installing Forefront Server products


There are several different accounts and permissions that are required for successful installation of Forefront server products. This blog discusses those accounts and permissions, however complex environments may need additional information not covered in this blog and should contact Support for assistance.


 


1-      Forefront Server Security for SharePoint (FSSP)


 


Accounts needed for installing FSSP:


          Requires an existing domain account with membership in the local Administrators group on the SharePoint server where FSSP is being installed.  This account can either be used to log on locally at the server, or to execute setup.exe using the runas command. 


Note: This assumes that the local Administrators group is also the SharePoint administrators group


          Remote installations require administrator privileges on the remote computer


 


Account prompted for during FSSP installation wizard:


          This account must be a member of the local Administrators group on which the SharePoint Portal Server is installed (one who is a local administrator on the web server AND who has System Administrator rights on the database server).


          You cannot use the default “Administrator” account


          The user name must be entered in the format domain or servername\username


          Account must have “Log on as a Service” user right.


          FSSPController service is configured to run under this account


 


2-      Forefront Server Security for Exchange (FSE)


 


Accounts needed for installing FSE:


          Requires an existing domain account with membership in the local Administrators group on the Exchange server where FSE is being installed.  This account can either be used to log on locally at the server, or to execute setup.exe using the runas command. 


Note: This assumes that the local Administrators group is also the Exchange Organization Administrators group, under the domain “Microsoft Exchange Security Group”


          Remote installations require administrator privileges on the remote computer


 


Account prompted for during FSE installation wizard:


          This account must be a member of the local Administrators group on the server where Exchange is installed.


          You cannot use the default “Administrator” account


          The user name must be entered in the format domain or servername\username


          Account must have “Log on as a Service” user right.


 


3-      Forefront Server Security Management Console (FSSMC)


 


Accounts needed for installing FSSMC:


          Requires an existing domain account with membership in the local Administrators group on the FSSMC server. 


Note: This account can either be used to log on locally at the server, or to execute setup.exe using the runas command. 


          The user account utilized to install the FSSMC (called the Installation Administrator) is automatically granted access to the FSSMC


 


Accounts prompted for during FSSMC installation wizard:


          For a Standalone Enterprise Installation, a domain account must be provided during setup that has access to the SQL repository. This account is automatically given access to the FSSMC database user list.


o   Account must be given db_owner permissions to the SybariEnterpriseManager and SybariEnterpriseManagerReports databases


§  Databases must exist in a single instance


§  Instance does not need to be exclusive


o   If installing on a Primary or Backup role, the user must have sys_admin and local admin role.


Note: FSSMC service will be configured to run under this account automatically


 


 


Important: The domain account that is used during setup to access the SQL Repository must have the user right of “Allow Logon Locally” on the front end FSSMC server.  In a default configuration, the Users group has the “Allow Logon Locally” right.  The User group includes Authenticated Users, so any Domain User would have this right.  However, in a hardened environment the Users group may have been removed.  If it has been removed, then during setup when clicking Test Connection, the connection test succeeds but after clicking Next, the setup will simply close with no error presented or logged.


 


          Express Installation does not prompt for any user accounts during the installation wizard.


 


Accounts created automatically with installation of FSSMC (no user intervention required):


 


          Express Installation:


o   The SMGR_ServerName account is created and the FSSMC service runs under that account


o    Account also provides access to local database (automatically)


 


          All installations:


o   SNTF_ ServerName and SUSER­_ ServerName accounts are created on FSSMC server


§  FSSMC Web Application runs under the SUSER_ ServerName account and only this account has access to the FSSMC service


§  When deploying agents to FSSP and FSE servers, FSSMC saves the credentials of the SNTF_ ServerName account to the managed FSSP and FSE servers, so that these servers can communicate back to FSSMC as needed.


§  On the FSSMC server, the SNTF_ ServerName account has Local and Remote access for the Access and the Launch and Activation permissions for the Forefront COM Component.


o   FSSMC also creates an account on managed servers named SDEP_ ServerName during the deployment of the FSSMC agent and uses that account’s credentials to communicate with the managed servers.


§  On the managed servers, the SDEP_ ServerName account has Local and Remote access for the Access and the Launch and Activation permission for the Forefront COM Component.


Other Accounts:


 


          FSSMC Agent Installation account


o   Used to access selected servers and install agent from FSSMC


o   Format of  domain\username or server\username


o   User name and password you provide must have administrative rights as a local administrator to the server or be a domain administrator.


o   Can enter one set of credentials for all the servers (by selecting Use these credentials for all) or enter credentials separately for each server.


              


4-      Additional Information


 


          When configuring Primary and Backup mode installations of FSSMC, SQL must be configured to support Windows Authentication (instead of SQL Authentication) and the account used to access the SQL server must have “Log on as Interactive” privileges on the FSSMC machine.


          Interaction between FSSMC and FSSP servers


o   FSSMC utilizes the DCOM interface exposed by the FSSMC agent on the managed server.


o   FSSMC Agent responds to the COM+ interface on the FSSMC server.


 

Comments (2)

  1. Showbox apk download strategy is suitable for all Smartphone brands like Sony, HTC, Samsung, Lenovo and Asus and so on. Showbox App is for these mobiles, as well as works for all Android based telephones. This instructional exercise is about, how to download
    Showbox apk record for your Android.

    http://showboxappdownloads.net/
    http://showboxappdownloads.net/showbox-apk/

    Showbox App takes a shot at Laptop too. Yes, this (Showbox.apk) document additionally underpins your PC by the utilization of an emulator. I’ll post an alternate instructional exercise for that also, yet for the time being this is for the people who are having
    Smartphones. Here is a brief introduction with respect to Showbox application.

    http://showboxappk.com/
    http://showboxappk.com/showbox-android-install-show-box/

    Showbox is not a standard Android application, it’s a stunning wellspring of stimulation. This announcement is given by me, as well as the general population who are utilizing it. It gives heaps of TV appears and motion pictures to watch at no expense.

    http://showboxandroids.com/
    http://showboxandroids.com/showbox-apk/
    http://showboxandroids.com/showbox-for-pc/

    Such a variety of variants were discharged in 2015 and first and foremost of 2016, a large portion of them are working great. Showbox 4.27 apk is one among them and the most recent variant is likewise profit here. Be that as it may, you can watch them in three
    distinct routes as indicated by clarity. They are Low, Medium and High qualities. Take after the strides orchestrated underneath to introduce the application.

    http://blogs.technet.com/b/fssnerds/