Install/Update: Local Account or Local Admin Privileges?

Question

Please excuse a rather pedestrian question about server roles and install, but even a noob likes to get things right.

I believe I've got a clear understanding of the information in the Quick Start Guide and Administrators Guide, but I'd just like to double check:

If installing on a server named NEBULA in a domain called GALAXY, which of these is most preferred/required, and/or which are to be avoided?

1) Local Account: NEBULA\ADMIN (built in account)
2) Local Account: NEBULA\ORION_SERVICE (member of Local Administrators Group)
3) Domain Account: GALAXY\ORION_SERVICE (member of Local Administrators Group on NEBULA)
4) Domain Account, Domain Admin:GALAXY\SERVER_ADMIN (nOT a member of Local Administrators Group on NEBULA).

I believe I've got them essentially stacked rank of preference, though I'm curious if there's any significant difference between 1 & 2, and 2 & 3?

I appreciate any insight people are willing to share.

joehanly · Accepted Answer

Hi Kevin

There is no real difference Between 1 @ 2 as they are both local accounts.

There is a difference Between 3 and 4 though . The account  3 is a service account and 4 is a domain admin account with far more privileges than the Service account.

If you are going to install Orion on  Nebula then use one of the First 2 accounts .They will ensure that you bypass any policies that may be locking your system down.

(In other words Log in locally to install everything)

In our experience in support a domain admin account usually is enough for installing but can in some environments be restrictive in terms of any IIS lockdown or Group policies lockdowns on the Servers said Domain (I.e galaxy)

I am not sure what your using the Service account For GALAXY\ORION_SERVICE

I wouldn’t use this to run Orion Services whether it in the admin group or not

Your Default Domain policy will probably require a password change at some point and could  disable this account.

Pick the default account (Local system) that Orion choose and run the Services as this

Regards

Joe Hanly