The server farm account should not be used for other services

Question

I have created a new SharePoint Foundation 2013 Farm. I only used the Farm Configuration Wizard to create the Search Service Application, all other aspects of the Farm was created using PowerShell.
The SharePoint Health Analyzer is reporting the following error:
Title: The server farm account should not be used for other services.
Severity: 1 - Error
Category: Security
Explanation: DOMAIN\FARM_ACCOUNT, the account used for the SharePoint timer service and the central administration site, is highly privileged and should not be used for any other services on any machines in the server farm.  The following services were
found to use this account: Distributed Cache Service(Windows Service)
Remedy: Browse to
http://centraladminsite:port/_admin/FarmCredentialManagement.aspx and change the account used for the services listed in the explanation. For more information about this rule, see "http://go.microsoft.com/fwlink/?LinkID=142685".
Now I understand how to change the account used to run the Distributed Cache Service, but my query is what account should I use in the least privelage model? I have setup the following 6 accounts as per TechNet guidelines (Link)
and am not sure if one of these accounts should be used or if another account is required:
SQL Server service account
Setup user account
Server farm account
SharePoint Server Search service account
Default content access account
Application pool identity
After reviewing the TechNet article again, I don't fully understand the section titled "Service application accounts". Is the article advising me to create a seperate account for each row in the table? e.g. 1 account for Business Data Connectivity
Service, a different account for "Application Discovery and Load Balancer Service", another account for "App management" and another account for "Distributed Cache", so 4 extra accounts if I choose to install all of these services
within the Farm?
Also, what does the article mean when it says "Plan one set of an application pool and proxy group for each service application that you plan to implement."? How do I go about doing this?
Kevin Evans

Answer 1

After reviewing the TechNet article again, I don't fully understand the section titled "Service application accounts". Is the article advising me to create a seperate account for each row in the table? e.g. 1 account for Business Data Connectivity Service,
a different account for "Application Discovery and Load Balancer Service", another account for "App management" and another account for "Distributed Cache", so 4 extra accounts if I choose to install all of these services within the Farm?
Inder: Yes, It is suggested to have multiple service account for each service application. This increases security and dependencyof 1 account on multiple Service applications. Like below
SQL Server service
Local System account (default)
Setup user
Member of the Administrators group on the local computer
Server farm
Network Service (default)
No manual configuration is necessary.
SharePoint Server Search Service
By default, this account runs as the Local System account.
If you want to crawl remote content by changing the default content access account or by using crawl rules, change this to a domain user account. If you do not change this account to a domain user account, you cannot change the default content access account
to a domain user account or add crawl rules to crawl this content. This restriction is designed to prevent elevation of privilege for any other process running as the Local System account.
Default Content Access
No manual configuration is necessary if this account is only crawling local farm content. If you want to crawl remote content by using crawl rules, change this to a domain user account, and apply the requirements listed for a server farm.
Content Access
Same requirement as the default content access account.
Profile import Default Access
Same requirements as server farm.
Excel Services Unattended Service
Must be a domain user account.
http://technet.microsoft.com/en-us/library/cc263445%28v=office.15%29.aspx
Also, what does the article mean when it says "Plan one set of an application pool and proxy group for each service application that you plan to implement."? How do I go about doing this?
Inder: Each service account has a application pool and you can plan to use same application pool for multiple
service accounts if required. These application pool are then consumed by proxy connection
of each service application. On service application pool, you can see all the service applications and its proxy connection.
If this helped you resolve your issue, please mark it Answered