Logging to SharePoint and its environment with the setup account - Is this a safe practice ?

Question

Hello,
Many of us are very familiar with the suggested accounts: http://technet.microsoft.com/en-us/library/cc263445(v=office.15).aspx#Subsection2  and http://www.toddklindt.com/blog/Lists/Posts/Post.aspx?ID=391
And we always hear from experts that we should never ever login (Interactive login) to the environment using the FarmAccount e.g. (sp_farm) because this is one of the worst practices and sometimes the the health analyzer will report errors and alerts if
the farm account is used in interactive logins.
OK I understand, I get this part, and I will never ever login using the farm account.
But what about the installation account e.g. (sp_setup)? can I login (interactive login) to the environment and the SharePoint sites using it and doing some changes with it? is that a safe practice? or is it an unforgivable sin too?
Thanks !

Answer 1

There's a load of reasons why it's a bad idea.
Your admins shouldn't be routinely using that account as it has too many things depending on it and so accidental locks could cause issues.
It's a pain to change it so if a disgruntled admin leaves the company there's a good chance the password won't change, leaving you a potential threat if you've done other silly things.
You have no audit trails showing who used the account.
It has too much access for routine use, allowing a malicious or inept admin to do a lot of damage.
Whilst you might use a keysafe system if it's short enough to remember and type easily then it's not secure enough given its' massive power.
It leads to assumptions about access that will cause you trouble if you ever try to do things right at a later stage
etc.
You should be using individual named AD accounts, ideally separate from normal user accounts and managed through AD groups. These groups should be audited on a regular basis to trim back users to only those who need access. This isn't a SharePoint concept,
this is a fundamental security process.
For references may I recommend Computer Security - Principals and Practice by William Stallings and Lawrie Brown (Part 3).