Tim Elhajj

Off the Microsoft stack!

How Much Permission Should TFS Service Accounts Have?

2 Comments

service-accounts

Recently a customer wrote to make sure that the TFS Service accounts they were using were permissioned with the bare minimum of privileges required to run TFS. This is smart. When dealing with permissions and service accounts, less is always best.

You never want to give your service account more permissions than required to run the application on which its setup. Why? Prudence. If someone manages to compromise your service account—or any account you manage, for that matter—your data and assets are at less risk, if the compromised account only has access to exactly the permissions it needs.

For the service accounts of the various components that come on the TFS 2010 DVD, that mostly means giving the service account the Log on as a Service permission. For the service account for the TFS application tier, you have to do a little more—it needs to appear in the Content Manger role on the Report Server (if you are using a report server) and the Farm Administrators group on SharePoint (if you’re using SharePoint).

All this information is documented in this topic, in the TFS installation guide.

Remember: You don’t want to give your service accounts too little permission, or the application won’t function correctly. But you don’t want to give your service accounts too much permission, because it’s risky. Instead you want to give your service accounts the exact amount of permissions they require.

Author: Tim Elhajj

Tim is probably walking his dog.

2 thoughts on “How Much Permission Should TFS Service Accounts Have?

  1. Pingback: May 10, 2011 – Visual Studio and TFS Daily | Learn TFS

  2. Pingback: VS ALM Library Updates on MSDN for May 2011 - MSDN Blogs

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s