Revoking SecurityAdmin & DB Creator Rights after EPM deployment

[FaisalM]

My questions is regarding permissions granted to Server Farm account under
section "Server farm-level accounts" in the following document.

Plan for administrative and service accounts (Project Server)

http://technet2.microsoft.com/Office/en-us/library/a2388ad0-a39b-486c-9cc9-2a352935a6b61033.mspx

We have multiple accounts for each component as per that document. After
initial setup & configuration, can we revoke SecurityAdmin SQL, DBCreator &
Logins rights for Farm admin account & some of the other service account
used? What would be the effects of revoking that right on EPM?

I can think revoking dbcreator would not allow us to create / provision new
Project Server instances. What other things would be affected?

This is something we haven't tested & looking for feedback from other folks.


Thanks

--
FaisalM
http://www.FaisalMasood.com/

View my Project & Sharepoint Blogs
http://www.faisalmasood.com/

 

[Paul Conroy]

You can certainly removed security admin and DBcreator rights. You are
correct in thinking that without these permissions you will not be able to
provision new instances of PWA or perform any other actions that need to
create new DBs.

The account under which the SSP runs will need Read/Write access to the DBs.